CVE-2016-6445

CWE-20 — Improper Input Validation4 documents4 sources
Severity
9.1CRITICAL
EPSS
0.8%
top 26.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Meeting Server
Timeline
PublishedOct 27
Latest updateMay 17

Description

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5cisco_meeting_server_(cms)_before_2.0.6_and_acano_server_before_1.8.18_and_1.9.x_before_1.9.6Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6
▶NVDcisco/meeting_server9 versions+8

🔴Vulnerability Details

2
GHSA
GHSA-gcmr-695p-fx75: A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2↗2022-05-17
▶
CVEList
CVE-2016-6445: A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2↗2016-10-27
▶

📋Vendor Advisories

1
Cisco
Cisco Meeting Server Client Authentication Bypass Vulnerability↗2016-10-12
▶
CVE-2016-6445 (CRITICAL CVSS 9.1) | A vulnerability in the Extensible M | cvebase.io