Vulnerability-Lookup

CVE-2024-20255 (GCVE-0-2024-20255)

Vulnerability from cvelistv5 – Published: 2024-02-07 16:15 – Updated: 2025-05-08 18:48

Summary

A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-08 18:47 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

cisco CNA under the mitre root

CNA scorecard C 66/100 over 442 records in the last 180 days details

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version	CPE status
Cisco	Cisco TelePresence Video Communication Server (VCS) Expressway	Affected: X8.5.1 Affected: X8.5.3 Affected: X8.5 Affected: X8.6.1 Affected: X8.6 Affected: X8.1.1 Affected: X8.1.2 Affected: X8.1 Affected: X8.2.1 Affected: X8.2.2 Affected: X8.2 Affected: X8.7.1 Affected: X8.7.2 Affected: X8.7.3 Affected: X8.7 Affected: X8.8.1 Affected: X8.8.2 Affected: X8.8.3 Affected: X8.8 Affected: X8.9.1 Affected: X8.9.2 Affected: X8.9 Affected: X8.10.0 Affected: X8.10.1 Affected: X8.10.2 Affected: X8.10.3 Affected: X8.10.4 Affected: X12.5.8 Affected: X12.5.9 Affected: X12.5.0 Affected: X12.5.2 Affected: X12.5.7 Affected: X12.5.3 Affected: X12.5.4 Affected: X12.5.5 Affected: X12.5.1 Affected: X12.5.6 Affected: X12.6.0 Affected: X12.6.1 Affected: X12.6.2 Affected: X12.6.3 Affected: X12.6.4 Affected: X12.7.0 Affected: X12.7.1 Affected: X8.11.1 Affected: X8.11.2 Affected: X8.11.4 Affected: X8.11.3 Affected: X8.11.0 Affected: X14.0.1 Affected: X14.0.3 Affected: X14.0.2 Affected: X14.0.4 Affected: X14.0.5 Affected: X14.0.6 Affected: X14.0.7 Affected: X14.0.8 Affected: X14.0.9 Affected: X14.0.10 Affected: X14.0.11 Affected: X14.2.1 Affected: X14.2.2 Affected: X14.2.5 Affected: X14.2.6 Affected: X14.2.0 Affected: X14.2.7 Affected: X14.3.0 Affected: X14.3.1 Affected: X14.3.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:52:31.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-expressway-csrf-KnnZDMj3",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20255",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T18:47:50.201453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T18:48:03.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "X8.5.1"
            },
            {
              "status": "affected",
              "version": "X8.5.3"
            },
            {
              "status": "affected",
              "version": "X8.5"
            },
            {
              "status": "affected",
              "version": "X8.6.1"
            },
            {
              "status": "affected",
              "version": "X8.6"
            },
            {
              "status": "affected",
              "version": "X8.1.1"
            },
            {
              "status": "affected",
              "version": "X8.1.2"
            },
            {
              "status": "affected",
              "version": "X8.1"
            },
            {
              "status": "affected",
              "version": "X8.2.1"
            },
            {
              "status": "affected",
              "version": "X8.2.2"
            },
            {
              "status": "affected",
              "version": "X8.2"
            },
            {
              "status": "affected",
              "version": "X8.7.1"
            },
            {
              "status": "affected",
              "version": "X8.7.2"
            },
            {
              "status": "affected",
              "version": "X8.7.3"
            },
            {
              "status": "affected",
              "version": "X8.7"
            },
            {
              "status": "affected",
              "version": "X8.8.1"
            },
            {
              "status": "affected",
              "version": "X8.8.2"
            },
            {
              "status": "affected",
              "version": "X8.8.3"
            },
            {
              "status": "affected",
              "version": "X8.8"
            },
            {
              "status": "affected",
              "version": "X8.9.1"
            },
            {
              "status": "affected",
              "version": "X8.9.2"
            },
            {
              "status": "affected",
              "version": "X8.9"
            },
            {
              "status": "affected",
              "version": "X8.10.0"
            },
            {
              "status": "affected",
              "version": "X8.10.1"
            },
            {
              "status": "affected",
              "version": "X8.10.2"
            },
            {
              "status": "affected",
              "version": "X8.10.3"
            },
            {
              "status": "affected",
              "version": "X8.10.4"
            },
            {
              "status": "affected",
              "version": "X12.5.8"
            },
            {
              "status": "affected",
              "version": "X12.5.9"
            },
            {
              "status": "affected",
              "version": "X12.5.0"
            },
            {
              "status": "affected",
              "version": "X12.5.2"
            },
            {
              "status": "affected",
              "version": "X12.5.7"
            },
            {
              "status": "affected",
              "version": "X12.5.3"
            },
            {
              "status": "affected",
              "version": "X12.5.4"
            },
            {
              "status": "affected",
              "version": "X12.5.5"
            },
            {
              "status": "affected",
              "version": "X12.5.1"
            },
            {
              "status": "affected",
              "version": "X12.5.6"
            },
            {
              "status": "affected",
              "version": "X12.6.0"
            },
            {
              "status": "affected",
              "version": "X12.6.1"
            },
            {
              "status": "affected",
              "version": "X12.6.2"
            },
            {
              "status": "affected",
              "version": "X12.6.3"
            },
            {
              "status": "affected",
              "version": "X12.6.4"
            },
            {
              "status": "affected",
              "version": "X12.7.0"
            },
            {
              "status": "affected",
              "version": "X12.7.1"
            },
            {
              "status": "affected",
              "version": "X8.11.1"
            },
            {
              "status": "affected",
              "version": "X8.11.2"
            },
            {
              "status": "affected",
              "version": "X8.11.4"
            },
            {
              "status": "affected",
              "version": "X8.11.3"
            },
            {
              "status": "affected",
              "version": "X8.11.0"
            },
            {
              "status": "affected",
              "version": "X14.0.1"
            },
            {
              "status": "affected",
              "version": "X14.0.3"
            },
            {
              "status": "affected",
              "version": "X14.0.2"
            },
            {
              "status": "affected",
              "version": "X14.0.4"
            },
            {
              "status": "affected",
              "version": "X14.0.5"
            },
            {
              "status": "affected",
              "version": "X14.0.6"
            },
            {
              "status": "affected",
              "version": "X14.0.7"
            },
            {
              "status": "affected",
              "version": "X14.0.8"
            },
            {
              "status": "affected",
              "version": "X14.0.9"
            },
            {
              "status": "affected",
              "version": "X14.0.10"
            },
            {
              "status": "affected",
              "version": "X14.0.11"
            },
            {
              "status": "affected",
              "version": "X14.2.1"
            },
            {
              "status": "affected",
              "version": "X14.2.2"
            },
            {
              "status": "affected",
              "version": "X14.2.5"
            },
            {
              "status": "affected",
              "version": "X14.2.6"
            },
            {
              "status": "affected",
              "version": "X14.2.0"
            },
            {
              "status": "affected",
              "version": "X14.2.7"
            },
            {
              "status": "affected",
              "version": "X14.3.0"
            },
            {
              "status": "affected",
              "version": "X14.3.1"
            },
            {
              "status": "affected",
              "version": "X14.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-07T16:15:36.068Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-expressway-csrf-KnnZDMj3",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
        }
      ],
      "source": {
        "advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
        "defects": [
          "CSCwa25074"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20255",
    "datePublished": "2024-02-07T16:15:36.068Z",
    "dateReserved": "2023-11-08T15:08:07.622Z",
    "dateUpdated": "2025-05-08T18:48:03.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-20255",
      "date": "2026-10-24",
      "epss": "0.00603",
      "percentile": "0.48241"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7131565E-A9DB-4C80-9935-5312E2BE2994",
                  "versionEndExcluding": "15.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
        },
        {
          "lang": "es",
          "value": "Una vulnerabilidad en la API SOAP de Cisco Expressway Series y Cisco TelePresence Video Communication Server podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) en un sistema afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administraci\u00f3n basada en web de un sistema afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la API REST para que siga un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante hacer que el sistema afectado se recargue."
        }
      ],
      "id": "CVE-2024-20255",
      "lastModified": "2024-11-21T08:52:07.353",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 4.7,
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 4.2,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-07T17:15:10.327",
      "references": [
        {
          "source": "ykramarz@cisco.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
        }
      ],
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-352"
            }
          ],
          "source": "ykramarz@cisco.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-352"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
                "vendor": "Cisco",
                "versions": [
                  {
                    "status": "affected",
                    "version": "X8.5.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.5.3"
                  },
                  {
                    "status": "affected",
                    "version": "X8.5"
                  },
                  {
                    "status": "affected",
                    "version": "X8.6.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.6"
                  },
                  {
                    "status": "affected",
                    "version": "X8.1.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.1.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.2.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.2.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.7.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.7.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.7.3"
                  },
                  {
                    "status": "affected",
                    "version": "X8.7"
                  },
                  {
                    "status": "affected",
                    "version": "X8.8.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.8.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.8.3"
                  },
                  {
                    "status": "affected",
                    "version": "X8.8"
                  },
                  {
                    "status": "affected",
                    "version": "X8.9.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.9.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.9"
                  },
                  {
                    "status": "affected",
                    "version": "X8.10.0"
                  },
                  {
                    "status": "affected",
                    "version": "X8.10.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.10.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.10.3"
                  },
                  {
                    "status": "affected",
                    "version": "X8.10.4"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.8"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.9"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.0"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.2"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.7"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.3"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.4"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.5"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.1"
                  },
                  {
                    "status": "affected",
                    "version": "X12.5.6"
                  },
                  {
                    "status": "affected",
                    "version": "X12.6.0"
                  },
                  {
                    "status": "affected",
                    "version": "X12.6.1"
                  },
                  {
                    "status": "affected",
                    "version": "X12.6.2"
                  },
                  {
                    "status": "affected",
                    "version": "X12.6.3"
                  },
                  {
                    "status": "affected",
                    "version": "X12.6.4"
                  },
                  {
                    "status": "affected",
                    "version": "X12.7.0"
                  },
                  {
                    "status": "affected",
                    "version": "X12.7.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.11.1"
                  },
                  {
                    "status": "affected",
                    "version": "X8.11.2"
                  },
                  {
                    "status": "affected",
                    "version": "X8.11.4"
                  },
                  {
                    "status": "affected",
                    "version": "X8.11.3"
                  },
                  {
                    "status": "affected",
                    "version": "X8.11.0"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.1"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.2"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.4"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.5"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.6"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.7"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.8"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.9"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.10"
                  },
                  {
                    "status": "affected",
                    "version": "X14.0.11"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.1"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.2"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.5"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.6"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.0"
                  },
                  {
                    "status": "affected",
                    "version": "X14.2.7"
                  },
                  {
                    "status": "affected",
                    "version": "X14.3.0"
                  },
                  {
                    "status": "affected",
                    "version": "X14.3.1"
                  },
                  {
                    "status": "affected",
                    "version": "X14.3.2"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7131565E-A9DB-4C80-9935-5312E2BE2994",
                    "versionEndExcluding": "15.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad en la API SOAP de Cisco Expressway Series y Cisco TelePresence Video Communication Server podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) en un sistema afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administraci\u00f3n basada en web de un sistema afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la API REST para que siga un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante hacer que el sistema afectado se recargue."
          }
        ],
        "id": "CVE-2024-20255",
        "lastModified": "2026-06-17T07:06:07.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-20255",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T18:47:50.201453Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-07T17:15:10.327",
        "references": [
          {
            "source": "psirt@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T20:48:15+00:00",
      "cve": "CVE-2024-20255",
      "id": "CVE-2024-20255",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-20255",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-20255.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T21:52:31.599Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "cisco-sa-expressway-csrf-KnnZDMj3",
                "tags": [
                  "x_transferred"
                ],
                "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-20255",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-05-08T18:47:50.201453Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-05-08T18:47:59.932Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
              "vendor": "Cisco",
              "versions": [
                {
                  "status": "affected",
                  "version": "X8.5.1"
                },
                {
                  "status": "affected",
                  "version": "X8.5.3"
                },
                {
                  "status": "affected",
                  "version": "X8.5"
                },
                {
                  "status": "affected",
                  "version": "X8.6.1"
                },
                {
                  "status": "affected",
                  "version": "X8.6"
                },
                {
                  "status": "affected",
                  "version": "X8.1.1"
                },
                {
                  "status": "affected",
                  "version": "X8.1.2"
                },
                {
                  "status": "affected",
                  "version": "X8.1"
                },
                {
                  "status": "affected",
                  "version": "X8.2.1"
                },
                {
                  "status": "affected",
                  "version": "X8.2.2"
                },
                {
                  "status": "affected",
                  "version": "X8.2"
                },
                {
                  "status": "affected",
                  "version": "X8.7.1"
                },
                {
                  "status": "affected",
                  "version": "X8.7.2"
                },
                {
                  "status": "affected",
                  "version": "X8.7.3"
                },
                {
                  "status": "affected",
                  "version": "X8.7"
                },
                {
                  "status": "affected",
                  "version": "X8.8.1"
                },
                {
                  "status": "affected",
                  "version": "X8.8.2"
                },
                {
                  "status": "affected",
                  "version": "X8.8.3"
                },
                {
                  "status": "affected",
                  "version": "X8.8"
                },
                {
                  "status": "affected",
                  "version": "X8.9.1"
                },
                {
                  "status": "affected",
                  "version": "X8.9.2"
                },
                {
                  "status": "affected",
                  "version": "X8.9"
                },
                {
                  "status": "affected",
                  "version": "X8.10.0"
                },
                {
                  "status": "affected",
                  "version": "X8.10.1"
                },
                {
                  "status": "affected",
                  "version": "X8.10.2"
                },
                {
                  "status": "affected",
                  "version": "X8.10.3"
                },
                {
                  "status": "affected",
                  "version": "X8.10.4"
                },
                {
                  "status": "affected",
                  "version": "X12.5.8"
                },
                {
                  "status": "affected",
                  "version": "X12.5.9"
                },
                {
                  "status": "affected",
                  "version": "X12.5.0"
                },
                {
                  "status": "affected",
                  "version": "X12.5.2"
                },
                {
                  "status": "affected",
                  "version": "X12.5.7"
                },
                {
                  "status": "affected",
                  "version": "X12.5.3"
                },
                {
                  "status": "affected",
                  "version": "X12.5.4"
                },
                {
                  "status": "affected",
                  "version": "X12.5.5"
                },
                {
                  "status": "affected",
                  "version": "X12.5.1"
                },
                {
                  "status": "affected",
                  "version": "X12.5.6"
                },
                {
                  "status": "affected",
                  "version": "X12.6.0"
                },
                {
                  "status": "affected",
                  "version": "X12.6.1"
                },
                {
                  "status": "affected",
                  "version": "X12.6.2"
                },
                {
                  "status": "affected",
                  "version": "X12.6.3"
                },
                {
                  "status": "affected",
                  "version": "X12.6.4"
                },
                {
                  "status": "affected",
                  "version": "X12.7.0"
                },
                {
                  "status": "affected",
                  "version": "X12.7.1"
                },
                {
                  "status": "affected",
                  "version": "X8.11.1"
                },
                {
                  "status": "affected",
                  "version": "X8.11.2"
                },
                {
                  "status": "affected",
                  "version": "X8.11.4"
                },
                {
                  "status": "affected",
                  "version": "X8.11.3"
                },
                {
                  "status": "affected",
                  "version": "X8.11.0"
                },
                {
                  "status": "affected",
                  "version": "X14.0.1"
                },
                {
                  "status": "affected",
                  "version": "X14.0.3"
                },
                {
                  "status": "affected",
                  "version": "X14.0.2"
                },
                {
                  "status": "affected",
                  "version": "X14.0.4"
                },
                {
                  "status": "affected",
                  "version": "X14.0.5"
                },
                {
                  "status": "affected",
                  "version": "X14.0.6"
                },
                {
                  "status": "affected",
                  "version": "X14.0.7"
                },
                {
                  "status": "affected",
                  "version": "X14.0.8"
                },
                {
                  "status": "affected",
                  "version": "X14.0.9"
                },
                {
                  "status": "affected",
                  "version": "X14.0.10"
                },
                {
                  "status": "affected",
                  "version": "X14.0.11"
                },
                {
                  "status": "affected",
                  "version": "X14.2.1"
                },
                {
                  "status": "affected",
                  "version": "X14.2.2"
                },
                {
                  "status": "affected",
                  "version": "X14.2.5"
                },
                {
                  "status": "affected",
                  "version": "X14.2.6"
                },
                {
                  "status": "affected",
                  "version": "X14.2.0"
                },
                {
                  "status": "affected",
                  "version": "X14.2.7"
                },
                {
                  "status": "affected",
                  "version": "X14.3.0"
                },
                {
                  "status": "affected",
                  "version": "X14.3.1"
                },
                {
                  "status": "affected",
                  "version": "X14.3.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
                "version": "3.1"
              },
              "format": "cvssV3_1"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "cwe"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-02-07T16:15:36.068Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "name": "cisco-sa-expressway-csrf-KnnZDMj3",
              "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
            }
          ],
          "source": {
            "advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
            "defects": [
              "CSCwa25074"
            ],
            "discovery": "INTERNAL"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2024-20255",
        "datePublished": "2024-02-07T16:15:36.068Z",
        "dateReserved": "2023-11-08T15:08:07.622Z",
        "dateUpdated": "2025-05-08T18:48:03.125Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2024-AVI-0103

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une injection de requêtes illégitimes par rebond (CSRF).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Pour une correction complète sur les produits Cisco Expressway Series, la commande suivante doit être exécutée :

xconfiguration Security CSRFProtection status : "Enabled"

Impacted products

Vendor	Product	Description
Cisco	N/A	Secure Endpoint Connector versions 7.5.x antérieures à 7.5.17 pour Windows
Cisco	N/A	Secure Endpoint Private Cloud versions antérieures à 3.8.0
Cisco	Expressway Series	Cisco Expressway Series toutes versions antérieures à 14.3.4 sans exécution de la commande ci-dessous
Cisco	N/A	Secure Endpoint Connector versions 8.2.x antérieures à 8.2.1 pour Windows
Cisco	Expressway Series	Cisco Expressway Series 15.0.x versions antérieures à 15.0.0 sans exécution de la commande ci-dessous

References

Title

Publication Time

CERTFR-2024-AVI-0103

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Pour une correction complète sur les produits Cisco Expressway Series, la commande suivante doit être exécutée :

xconfiguration Security CSRFProtection status : "Enabled"

Impacted products

Vendor	Product	Description
Cisco	N/A	Secure Endpoint Connector versions 7.5.x antérieures à 7.5.17 pour Windows
Cisco	N/A	Secure Endpoint Private Cloud versions antérieures à 3.8.0
Cisco	Expressway Series	Cisco Expressway Series toutes versions antérieures à 14.3.4 sans exécution de la commande ci-dessous
Cisco	N/A	Secure Endpoint Connector versions 8.2.x antérieures à 8.2.1 pour Windows
Cisco	Expressway Series	Cisco Expressway Series 15.0.x versions antérieures à 15.0.0 sans exécution de la commande ci-dessous

References

Title

Publication Time

BDU:2024-01373 (CVE-2024-20255)

Vulnerability from fstec – Published: 2024-02-19 – Updated: 2025-02-07 – View on bdu.fstec.ru Fixed

Title

Summary

Уязвимость реализации прикладного программного интерфейса микропрограммного обеспечения шлюзов Cisco Expressway и микропрограммного обеспечения устройств управления вызовами Cisco TelePresence Video Communication Server связана с подделкой межсайтовых запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, осуществить CSRF-атаку с помощью специально созданной ссылки

Severity

8.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:C/A:P

8.2 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-352 - Межсайтовая фальсификация запросов

Aliases

CVE-2024-20255

References

2 references

URL
https://www.cisco.com/c/en/us/products/collateral/unified-communications/telepr…
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/c…

Impacted products

2 products from 2 vendors

Vendors

Cisco Systems, Inc.

Products

TelePresence Video Communication Server, Cisco Expressway

Versions

- (TelePresence Video Communication Server), до 14.3.4 (Cisco Expressway), до 15.0.0 (Cisco Expressway)

Product types

Network appliance software

Mitigations

Использование рекомендаций: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:C/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (TelePresence Video Communication Server), \u0434\u043e 14.3.4 (Cisco Expressway), \u0434\u043e 15.0.0 (Cisco Expressway)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "07.02.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "07.02.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.02.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-01373",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-20255",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "TelePresence Video Communication Server, Cisco Expressway",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Cisco Expressway \u0438 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u044b\u0437\u043e\u0432\u0430\u043c\u0438 Cisco TelePresence Video Communication Server, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c CSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u0430\u044f \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (CWE-352)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0448\u043b\u044e\u0437\u043e\u0432 Cisco Expressway \u0438 \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u044b\u0437\u043e\u0432\u0430\u043c\u0438 Cisco TelePresence Video Communication Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u043e\u0439 \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c CSRF-\u0430\u0442\u0430\u043a\u0443 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cisco.com/c/en/us/products/collateral/unified-communications/telepresence-video-communication-server-vcs/eos-eol-notice-c51-743969.html\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-352",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

CISCO-SA-EXPRESSWAY-CSRF-KNNZDMJ3

Vulnerability from csaf_cisco - Published: 2024-02-07 16:00 - Updated: 2024-02-12 17:55

Summary

Cisco Expressway Series Cross-Site Request Forgery Vulnerabilities

Scope

3 vulnerabilities in this advisory, including CVE-2024-20255.

CVE-2024-20255

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Known affected: 1 product

https://software.cisco.com

Open the full advisory

CNVD-2025-06740

Vulnerability from cnvd - Published: 2025-04-08

Title

Cisco Expressway Series跨站请求伪造漏洞（CNVD-2025-06740）

Description

Cisco Expressway Series是美国思科(Cisco)公司的一款用于防火墙外访问设备的软件。 Cisco Expressway Series存在跨站请求伪造漏洞，攻击者可利用该漏洞修改敏感信息或者执行未授权操作。

Severity

高

Patch Name

Cisco Expressway Series跨站请求伪造漏洞（CNVD-2025-06740）的补丁

Patch Description

Cisco Expressway Series是美国思科(Cisco)公司的一款用于防火墙外访问设备的软件。 Cisco Expressway Series存在跨站请求伪造漏洞，攻击者可利用该漏洞修改敏感信息或者执行未授权操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-20255

Impacted products

Name
Cisco Cisco Expressway Series <15.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-20255",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20255"
    }
  },
  "description": "Cisco Expressway Series\u662f\u7f8e\u56fd\u601d\u79d1(Cisco)\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u9632\u706b\u5899\u5916\u8bbf\u95ee\u8bbe\u5907\u7684\u8f6f\u4ef6\u3002\n\nCisco Expressway Series\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4fee\u6539\u654f\u611f\u4fe1\u606f\u6216\u8005\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-06740",
  "openTime": "2025-04-08",
  "patchDescription": "Cisco Expressway Series\u662f\u7f8e\u56fd\u601d\u79d1(Cisco)\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u9632\u706b\u5899\u5916\u8bbf\u95ee\u8bbe\u5907\u7684\u8f6f\u4ef6\u3002\r\n\r\nCisco Expressway Series\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4fee\u6539\u654f\u611f\u4fe1\u606f\u6216\u8005\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Expressway Series\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff08CNVD-2025-06740\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Cisco Expressway Series \u003c15.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-20255",
  "serverity": "\u9ad8",
  "submitTime": "2024-02-19",
  "title": "Cisco Expressway Series\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff08CNVD-2025-06740\uff09"
}

FKIE_CVE-2024-20255

Vulnerability from fkie_nvd - Published: 2024-02-07 17:15 - Updated: 2026-06-17 07:06

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3	Vendor Advisory

Impacted products

	Vendor	Product	Version
	cisco	expressway	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Cisco TelePresence Video Communication Server (VCS) Expressway",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "X8.5.1"
            },
            {
              "status": "affected",
              "version": "X8.5.3"
            },
            {
              "status": "affected",
              "version": "X8.5"
            },
            {
              "status": "affected",
              "version": "X8.6.1"
            },
            {
              "status": "affected",
              "version": "X8.6"
            },
            {
              "status": "affected",
              "version": "X8.1.1"
            },
            {
              "status": "affected",
              "version": "X8.1.2"
            },
            {
              "status": "affected",
              "version": "X8.1"
            },
            {
              "status": "affected",
              "version": "X8.2.1"
            },
            {
              "status": "affected",
              "version": "X8.2.2"
            },
            {
              "status": "affected",
              "version": "X8.2"
            },
            {
              "status": "affected",
              "version": "X8.7.1"
            },
            {
              "status": "affected",
              "version": "X8.7.2"
            },
            {
              "status": "affected",
              "version": "X8.7.3"
            },
            {
              "status": "affected",
              "version": "X8.7"
            },
            {
              "status": "affected",
              "version": "X8.8.1"
            },
            {
              "status": "affected",
              "version": "X8.8.2"
            },
            {
              "status": "affected",
              "version": "X8.8.3"
            },
            {
              "status": "affected",
              "version": "X8.8"
            },
            {
              "status": "affected",
              "version": "X8.9.1"
            },
            {
              "status": "affected",
              "version": "X8.9.2"
            },
            {
              "status": "affected",
              "version": "X8.9"
            },
            {
              "status": "affected",
              "version": "X8.10.0"
            },
            {
              "status": "affected",
              "version": "X8.10.1"
            },
            {
              "status": "affected",
              "version": "X8.10.2"
            },
            {
              "status": "affected",
              "version": "X8.10.3"
            },
            {
              "status": "affected",
              "version": "X8.10.4"
            },
            {
              "status": "affected",
              "version": "X12.5.8"
            },
            {
              "status": "affected",
              "version": "X12.5.9"
            },
            {
              "status": "affected",
              "version": "X12.5.0"
            },
            {
              "status": "affected",
              "version": "X12.5.2"
            },
            {
              "status": "affected",
              "version": "X12.5.7"
            },
            {
              "status": "affected",
              "version": "X12.5.3"
            },
            {
              "status": "affected",
              "version": "X12.5.4"
            },
            {
              "status": "affected",
              "version": "X12.5.5"
            },
            {
              "status": "affected",
              "version": "X12.5.1"
            },
            {
              "status": "affected",
              "version": "X12.5.6"
            },
            {
              "status": "affected",
              "version": "X12.6.0"
            },
            {
              "status": "affected",
              "version": "X12.6.1"
            },
            {
              "status": "affected",
              "version": "X12.6.2"
            },
            {
              "status": "affected",
              "version": "X12.6.3"
            },
            {
              "status": "affected",
              "version": "X12.6.4"
            },
            {
              "status": "affected",
              "version": "X12.7.0"
            },
            {
              "status": "affected",
              "version": "X12.7.1"
            },
            {
              "status": "affected",
              "version": "X8.11.1"
            },
            {
              "status": "affected",
              "version": "X8.11.2"
            },
            {
              "status": "affected",
              "version": "X8.11.4"
            },
            {
              "status": "affected",
              "version": "X8.11.3"
            },
            {
              "status": "affected",
              "version": "X8.11.0"
            },
            {
              "status": "affected",
              "version": "X14.0.1"
            },
            {
              "status": "affected",
              "version": "X14.0.3"
            },
            {
              "status": "affected",
              "version": "X14.0.2"
            },
            {
              "status": "affected",
              "version": "X14.0.4"
            },
            {
              "status": "affected",
              "version": "X14.0.5"
            },
            {
              "status": "affected",
              "version": "X14.0.6"
            },
            {
              "status": "affected",
              "version": "X14.0.7"
            },
            {
              "status": "affected",
              "version": "X14.0.8"
            },
            {
              "status": "affected",
              "version": "X14.0.9"
            },
            {
              "status": "affected",
              "version": "X14.0.10"
            },
            {
              "status": "affected",
              "version": "X14.0.11"
            },
            {
              "status": "affected",
              "version": "X14.2.1"
            },
            {
              "status": "affected",
              "version": "X14.2.2"
            },
            {
              "status": "affected",
              "version": "X14.2.5"
            },
            {
              "status": "affected",
              "version": "X14.2.6"
            },
            {
              "status": "affected",
              "version": "X14.2.0"
            },
            {
              "status": "affected",
              "version": "X14.2.7"
            },
            {
              "status": "affected",
              "version": "X14.3.0"
            },
            {
              "status": "affected",
              "version": "X14.3.1"
            },
            {
              "status": "affected",
              "version": "X14.3.2"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7131565E-A9DB-4C80-9935-5312E2BE2994",
              "versionEndExcluding": "15.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la API SOAP de Cisco Expressway Series y Cisco TelePresence Video Communication Server podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) en un sistema afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administraci\u00f3n basada en web de un sistema afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la API REST para que siga un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante hacer que el sistema afectado se recargue."
    }
  ],
  "id": "CVE-2024-20255",
  "lastModified": "2026-06-17T07:06:07.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-20255",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-05-08T18:47:50.201453Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-07T17:15:10.327",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-CCJ9-9HX6-VGJF

Vulnerability from github – Published: 2024-02-07 18:30 – Updated: 2024-02-07 18:30

Details

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-20255"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-07T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\n\n This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.",
  "id": "GHSA-ccj9-9hx6-vgjf",
  "modified": "2024-02-07T18:30:28Z",
  "published": "2024-02-07T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20255"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-20255

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2024-20255

Aliases

CVE-2024-20255

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2024-20255",
    "id": "GSD-2024-20255"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-20255"
      ],
      "details": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.",
      "id": "GSD-2024-20255",
      "modified": "2023-12-13T01:21:43.039013Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@cisco.com",
        "ID": "CVE-2024-20255",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Cisco TelePresence Video Communication Server (VCS) Expressway",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "X8.5.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.5.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.1.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.1.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.2.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.2.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.7.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.7.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.8.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.8.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.8.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.8"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.9.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.9.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.9"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.10.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.10.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.10.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.10.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.10.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.8"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.9"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.5.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.6.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.6.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.6.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.6.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.6.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.7.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X12.7.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.11.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.11.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.11.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.11.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X8.11.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.8"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.9"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.10"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.0.11"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.5"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.2.7"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.3.0"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.3.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "X14.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Cisco"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-352",
                "lang": "eng",
                "value": "Cross-Site Request Forgery (CSRF)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3",
            "refsource": "MISC",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
          }
        ]
      },
      "source": {
        "advisory": "cisco-sa-expressway-csrf-KnnZDMj3",
        "defects": [
          "CSCwa25074"
        ],
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7131565E-A9DB-4C80-9935-5312E2BE2994",
                    "versionEndExcluding": "15.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.\r\n\r This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad en la API SOAP de Cisco Expressway Series y Cisco TelePresence Video Communication Server podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) en un sistema afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administraci\u00f3n basada en web de un sistema afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la API REST para que siga un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante hacer que el sistema afectado se recargue."
          }
        ],
        "id": "CVE-2024-20255",
        "lastModified": "2024-02-15T15:54:19.960",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "ykramarz@cisco.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-07T17:15:10.327",
        "references": [
          {
            "source": "ykramarz@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3"
          }
        ],
        "sourceIdentifier": "ykramarz@cisco.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-0321

Vulnerability from csaf_certbund - Published: 2024-02-07 23:00 - Updated: 2024-02-07 23:00

Summary

Cisco Expressway: Mehrere Schwachstellen

Severity

Hoch

Scope

3 vulnerabilities in this advisory, including CVE-2024-20255.

CVE-2024-20255

In Cisco Expressway existieren mehrere Schwachstellen. Diese sind auf Anfälligkeiten für Cross-Site-Request-Forgery-Angriffe zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Angriffe ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen. Die Auswirkungen sind abhängig von den Berechtigungen des angegriffenen Nutzers. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-20255 (GCVE-0-2024-20255)

Solution

Solution

BDU:2024-01373 (CVE-2024-20255)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour