Lucene search

[email protected]CVE-2016-6445

HistoryOct 27, 2016 - 9:59 p.m.

CVE-2016-6445

2016-10-2721:59:17

CWE-20

[email protected]

web.nvd.nist.gov

cisco meeting server

acano server

xmpp

vulnerability

masquerade

authentication

remote attacker

cve-2016-6445

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.8%

JSON

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.

Affected configurations

NVD

Node

ciscomeeting_serverMatch1.8.15

ciscomeeting_serverMatch1.8_base

ciscomeeting_serverMatch1.9.0

ciscomeeting_serverMatch1.9.2

ciscomeeting_serverMatch2.0.0

ciscomeeting_serverMatch2.0.1

ciscomeeting_serverMatch2.0.3

ciscomeeting_serverMatch2.0.4

ciscomeeting_serverMatch2.0.5

CPENameOperatorVersion
cisco:meeting_servercisco meeting servereq1.8.15
cisco:meeting_servercisco meeting servereq1.8_base
cisco:meeting_servercisco meeting servereq1.9.0
cisco:meeting_servercisco meeting servereq1.9.2
cisco:meeting_servercisco meeting servereq2.0.0
cisco:meeting_servercisco meeting servereq2.0.1
cisco:meeting_servercisco meeting servereq2.0.3
cisco:meeting_servercisco meeting servereq2.0.4
cisco:meeting_servercisco meeting servereq2.0.5

CPE	Name	Operator	Version
cisco:meeting_server	cisco meeting server	eq	1.8.15
cisco:meeting_server	cisco meeting server	eq	1.8_base
cisco:meeting_server	cisco meeting server	eq	1.9.0
cisco:meeting_server	cisco meeting server	eq	1.9.2
cisco:meeting_server	cisco meeting server	eq	2.0.0
cisco:meeting_server	cisco meeting server	eq	2.0.1
cisco:meeting_server	cisco meeting server	eq	2.0.3
cisco:meeting_server	cisco meeting server	eq	2.0.4
cisco:meeting_server	cisco meeting server	eq	2.0.5

CNA Affected

[
  {
    "product": "Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc

www.securityfocus.com/bid/93517

www.securitytracker.com/id/1037000

Social References

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.8%

JSON

Related for CVE-2016-6445

openvas1 cvelist1 cisco1 prion1 nvd1 threatpost1