cisco-sa-cmm-privesc-uy2Vf8pc: Cisco Meeting Management REST API Privilege Escalation Vulnerability
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device.This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-privesc-uy2Vf8pc
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-cmm-privesc-uy2Vf8pc?
The severity of the cisco-sa-cmm-privesc-uy2Vf8pc vulnerability is considered high due to the potential for privilege escalation.
How do I fix cisco-sa-cmm-privesc-uy2Vf8pc?
To fix the cisco-sa-cmm-privesc-uy2Vf8pc vulnerability, ensure that you apply the latest security patches recommended by Cisco.
Who is affected by cisco-sa-cmm-privesc-uy2Vf8pc?
The cisco-sa-cmm-privesc-uy2Vf8pc vulnerability affects users of Cisco Meeting Management that have not implemented proper authorization controls.
What types of attacks can exploit cisco-sa-cmm-privesc-uy2Vf8pc?
Exploitations of the cisco-sa-cmm-privesc-uy2Vf8pc vulnerability may allow authenticated users to escalate their privileges to administrator level.
What are the recommended steps for mitigation of cisco-sa-cmm-privesc-uy2Vf8pc?
Recommended steps for mitigating cisco-sa-cmm-privesc-uy2Vf8pc include auditing API access policies and updating to the latest version of Cisco Meeting Management.