CVE-2023-20105

CWE-20 — Improper Input Validation CWE-269 — Improper Privilege Management4 documents4 sources

Severity

6.5MEDIUM

EPSS

0.1%

top 68.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Telepresence Video Communication Server Cisco Cisco Telepresence Video Communication Server (vcs) Expressway

Timeline

PublishedJun 28

Description

A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with Read-only credentials to elevate privileges to Administrator on an affected system. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by authenticating to the application as a Read-only user and sending a crafted request to the web-based man…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HExploitability: 3.1 | Impact: 5.8

Affected Packages2 packages

▶CVEListV5cisco/cisco_telepresence_video_communication_server_(vcs)_expressway62 versions+61

▶NVDcisco/telepresence_video_communication_serverx14.0.3

🔴Vulnerability Details

GHSA

GHSA-8vgw-329g-hrw6: Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated attacker with↗2023-06-28

▶

CVEList

CVE-2023-20105: A vulnerability in the change password functionality of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an↗2023-06-28

▶

📋Vendor Advisories

Cisco

Cisco Expressway Series and Cisco TelePresence Video Communication Server Privilege Escalation Vulnerabilities↗2023-06-07

▶