4.1
Medium
CVE-2019-1854 A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker…
Description
A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to bypass security restrictions and access the web interface of a Cisco Unified Communications Manager associated with the affected device. Valid credentials would still be required to access the Cisco Unified Communications Manager interface.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Expressway | Versions not published |
References
- 20190501 Cisco Expressway Series Directory Traversal Vulnerability tools.cisco.com
- 108154 www.securityfocus.com
- 20190517 [RT-SA-2019-002] Directory Traversal in Cisco Expressway Gateway seclists.org
- 20190517 [RT-SA-2019-002] Directory Traversal in Cisco Expressway Gateway seclists.org
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Last modified