CVE-2015-4328

CWE-20 — Improper Input Validation4 documents4 sources
Severity
4.0MEDIUM
EPSS
0.2%
top 52.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Telepresence Video Communication Server Software
Timeline
PublishedAug 20
Latest updateMay 17

Description

Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demonstrated by read or write operations on the Unified Communications lookup page, aka Bug ID CSCuv12552.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 8.0 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-565h-f96p-rpm8: Cisco TelePresence Video Communication Server (VCS) Expressway X8↗2022-05-17
▶
CVEList
CVE-2015-4328: Cisco TelePresence Video Communication Server (VCS) Expressway X8↗2015-08-20
▶

📋Vendor Advisories

1
Cisco
Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability↗2015-08-18
▶
CVE-2015-4328 (MEDIUM CVSS 4) | Cisco TelePresence Video Communicat | cvebase.io