cisco-sa-20191002-cucm-csrf: Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
First published: Wed Oct 02 2019(Updated: )
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =12.5<Apply patch file ciscocm_CSCvo42306_CSRFFix_12_5X_v1.8.cop.sgn or upgrade to 12.5(1)SU1.=12.0<Apply patch file ciscocm_CSCvo42306_CSRFFix_12_0X_v1.8.cop.sgn or upgrade to 12.0(1)SU3.=11.5<Apply patch file ciscocm_CSCvo42306_CSRFFix_11_5X_v1.8.cop.sgn or upgrade to 11.5(1)SU6.=11.0<11.5(1)SU6=10.5(2)<Apply patch file ciscocm_CSCvo42306_CSRFFix_105X_v1.5.cop.sgn or upgrade to 10.5(2)SU9.>=.5(2)<10<10.5(2)SU9 | Apply patch file ciscocm_CSCvo42306_CSRFFix_12_5X_v1.8.cop.sgn or upgrade to 12.5(1)SU1. Apply patch file ciscocm_CSCvo42306_CSRFFix_12_0X_v1.8.cop.sgn or upgrade to 12.0(1)SU3. Apply patch file ciscocm_CSCvo42306_CSRFFix_11_5X_v1.8.cop.sgn or upgrade to 11.5(1)SU6. 11.5(1)SU6 Apply patch file ciscocm_CSCvo42306_CSRFFix_105X_v1.5.cop.sgn or upgrade to 10.5(2)SU9. 10.5(2)SU9 |
| Cisco Unified Communications Manager IM and Presence Service | =12.5<Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_125X.cop.sgn or upgrade to 12.5(1)SU1.=12.0<12.5(1)SU1=11.5<Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_115X_v2.cop.sgn or upgrade to 11.5(1)SU6.=11.0<11.5(1)SU6=10.5(2)<Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_1052X.cop.sgn or upgrade to 10.5(2) ES.>=.5(2)<10<10.5(2) ES | Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_125X.cop.sgn or upgrade to 12.5(1)SU1. 12.5(1)SU1 Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_115X_v2.cop.sgn or upgrade to 11.5(1)SU6. 11.5(1)SU6 Apply patch file ciscocm_CSCvo99233_CSRFFixForCUP_1052X.cop.sgn or upgrade to 10.5(2) ES. 10.5(2) ES |
| Cisco Unity Connection | =12.5<Apply patch file ciscocm.CSCvo91541_CSRFFix_12.5x.k3.cop.sgn or upgrade to 12.5(1)SU1.=12.0<Apply patch file ciscocm.CSCvo91541_CSRFFix_12.0x.k3.cop.sgn or upgrade to 12.0(1)SU3.=11.5<Apply patch file ciscocm.CSCvo91541_CSRFFix_11.5x.k3.cop.sgn or upgrade to 11.5(1)SU6.=11.0<11.5(1)SU6=10.5(2)<Apply patch file ciscocm.CSCvo91541_CSRFFix_10.5x.k3.cop.sgn or upgrade to 10.5(2)SU9.>=.5(2)<10<10.5(2)SU9 | Apply patch file ciscocm.CSCvo91541_CSRFFix_12.5x.k3.cop.sgn or upgrade to 12.5(1)SU1. Apply patch file ciscocm.CSCvo91541_CSRFFix_12.0x.k3.cop.sgn or upgrade to 12.0(1)SU3. Apply patch file ciscocm.CSCvo91541_CSRFFix_11.5x.k3.cop.sgn or upgrade to 11.5(1)SU6. 11.5(1)SU6 Apply patch file ciscocm.CSCvo91541_CSRFFix_10.5x.k3.cop.sgn or upgrade to 10.5(2)SU9. 10.5(2)SU9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability?
The Cisco Unified Communications Products Cross-Site Request Forgery (CSRF) vulnerability is a security flaw in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection.
How severe is the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability?
The severity of the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability is medium with a severity score of 6.5.
Which Cisco products are affected by the Cross-Site Request Forgery vulnerability?
The Cross-Site Request Forgery vulnerability affects Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection.
How can I fix the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability?
To fix the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability, apply the recommended patch files or upgrade to the specified versions according to the Cisco security advisory.
What is the Common Weakness Enumeration (CWE) ID for the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability?
The Common Weakness Enumeration (CWE) ID for the Cisco Unified Communications Products Cross-Site Request Forgery vulnerability is CWE-352.
- agent/title
- agent/severity
- agent/references
- agent/type
- agent/event
- agent/weakness
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/12.5
- version/cisco unified communications manager/12.0
- version/cisco unified communications manager/11.5
- version/cisco unified communications manager/11.0
- version/cisco unified communications manager/10.5(2)
- version/cisco unified communications manager/.5(2)
- canonical/cisco unified communications manager im and presence service
- version/cisco unified communications manager im and presence service/12.5
- version/cisco unified communications manager im and presence service/12.0
- version/cisco unified communications manager im and presence service/11.5
- version/cisco unified communications manager im and presence service/11.0
- version/cisco unified communications manager im and presence service/10.5(2)
- version/cisco unified communications manager im and presence service/.5(2)
- canonical/cisco unity connection
- version/cisco unity connection/12.5
- version/cisco unity connection/12.0
- version/cisco unity connection/11.5
- version/cisco unity connection/11.0
- version/cisco unity connection/10.5(2)
- version/cisco unity connection/.5(2)