Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability (Cisco Cisco TelePresence Endpoint Software (TC/CE))
En bref
- Source
- NVD
- EPSS
- EPSS 0.73 % · centile 54 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Modified
Description
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.
Faiblesses (CWE)
- CWE-639 — Contournement d'autorisation par clé contrôlée par l'utilisateur (IDOR)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N | cisco |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-18698
- GCVE · GCVE-0-2020-26068
Configurations affectées (CPE NVD)
cpe:2.3:a:cisco:roomos:-:*:*:*:*:*:*:*cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:*≥ 9.10.0 < 9.10.3cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:*≥ 9.12.0 < 9.12.4
Produits affectés
| Produit | Versions |
|---|---|
| Cisco · Cisco TelePresence Endpoint Software (TC/CE) | affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |