Lucene search

K
cveCiscoCVE-2019-16017
HistorySep 23, 2020 - 1:15 a.m.

CVE-2019-16017

2020-09-2301:15:13
CWE-264
CWE-20
cisco
web.nvd.nist.gov
59
vulnerability
oamp
opsconsole server
cisco
unified cvp
authenticated
remote attacker
insecure direct object reference
input validation
dos condition

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

40.2%

A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to execute Insecure Direct Object Reference actions on specific pages within the OAMP application. The vulnerability is due to insufficient input validation on specific pages of the OAMP application. An attacker could exploit this vulnerability by authenticating to Cisco Unified CVP and sending crafted HTTP requests. A successful exploit could allow an attacker with administrator or read-only privileges to learn information outside of their expected scope. An attacker with administrator privileges could modify certain configuration details of resources outside of their defined scope, which could result in a denial of service (DoS) condition.

Affected configurations

Nvd
Node
ciscounified_customer_voice_portalRange<11.6\(1\)_es-11
Node
ciscounified_customer_voice_portalRange<12.0\(1\)_es-7
VendorProductVersionCPE
ciscounified_customer_voice_portal*cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Cisco Unified Customer Voice Portal (CVP)",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

40.2%

Related for CVE-2019-16017