A vulnerability, which was classified as problematic, was found in Cisco Unified MeetingPlace 8.6(1.9) (Unified Communication Software). Affected is an unknown part. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494.

The weakness was released 04/22/2015 with Cisco as 38461 as confirmed vulnerability alert (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2015-0705 since 01/07/2015. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available.

It is declared as highly functional.

The vulnerability is also documented in the vulnerability database at X-Force (102468). Entry connected to this vulnerability is available at 75035.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Unified MeetingPlace

Version

• 8.6(1.9)

License

• commercial

Support

• end of life (old version)

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion