Lucene search

[email protected]CVE-2015-4328

HistoryAug 20, 2015 - 12:59 a.m.

CVE-2015-4328

2015-08-2000:59:06

CWE-20

[email protected]

web.nvd.nist.gov

cisco

telepresence

vcs

expressway

cve-2015-4328

nvd

security vulnerability

cscuv12552

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account’s read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.

Affected configurations

NVD

Node

ciscotelepresence_video_communication_server_softwareMatchx8.5.2expressway

CPENameOperatorVersion
cisco:telepresence_video_communication_server_softwarecisco telepresence video communication server softwareeqx8.5.2

CPE	Name	Operator	Version
cisco:telepresence_video_communication_server_software	cisco telepresence video communication server software	eq	x8.5.2

References

tools.cisco.com/security/center/viewAlert.x?alertId=40522

www.securityfocus.com/bid/76399

www.securitytracker.com/id/1033329

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

Related for CVE-2015-4328

prion1 nvd1 cvelist1 cisco1