CWE Code: 352
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Cross-Site Request Forgery (CSRF)
Summary: a vulnerability in the findme feature of cisco expressway series and cisco telepresence video communication server (vcs) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (csrf) attack and perform arbitrary actions on an affected system. the vulnerability is due to insufficient csrf protections for the web-based management interface of the affected system. an attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. a successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. the arbitrary actions include adding an attacker-controlled device and redirecting calls intended for a specific user. for more information about csrf attacks and potential mitigations, see understanding cross-site request forgery threat vectors. this vulnerability is fixed in software version x12.5.1 and later.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2019-04-18
Last Modified Date: 2019-10-09
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Cross-Site Request Forgery (CSRF).
user
CWE Code: 352
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Cross-Site Request Forgery (CSRF)
Summary: a vulnerability in the findme feature of cisco expressway series and cisco telepresence video communication server (vcs) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (csrf) attack and perform arbitrary actions on an affected system. the vulnerability is due to insufficient csrf protections for the web-based management interface of the affected system. an attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. a successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. the arbitrary actions include adding an attacker-controlled device and redirecting calls intended for a specific user. for more information about csrf attacks and potential mitigations, see understanding cross-site request forgery threat vectors. this vulnerability is fixed in software version x12.5.1 and later.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2019-04-18
Last Modified Date: 2019-10-09
assistant