CVE-2019-1877
published 2019-11-05CVE-2019-1877: A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
1.44%
70.4th percentile
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_enterprise_chat_and_email | >= unspecified < 12.0(1)ES1 | 12.0(1)ES1 |
| cisco | enterprise_chat_and_email | — | — |
| cisco | enterprise_chat_and_email_attachment_download | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Enterprise Chat and Email Attachment Download Vulnerability
vendor_cisco·2019-06-19·CVSS 6.5
CVE-2019-1877 [MEDIUM] CWE-287 Cisco Enterprise Chat and Email Attachment Download Vulnerability
Cisco Enterprise Chat and Email Attachment Download Vulnerability
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions.
The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-ecea-dwnload
Cisco
Cisco Enterprise Chat and Email Attachment Download Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1877 Cisco Enterprise Chat and Email Attachment Download Vulnerability
CVE-2019-1877: Cisco Enterprise Chat and Email Attachment Download Vulnerability
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. There are no
CVSS: 3.0
CWE: CWE-287, CWE-287
Bug IDs: CSCvo99235
GHSA
GHSA-mcq8-w4cg-w5v4: A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through
ghsa_unreviewed·2022-05-24
CVE-2019-1877 [MEDIUM] GHSA-mcq8-w4cg-w5v4: A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-05
Published