SB2020010917 - Privilege escalation in Cisco Unified Customer Voice Portal
Published: January 9, 2020
Security Bulletin ID
SB2020010917
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-16017)
The vulnerability allows a remote user to execute Insecure Direct Object Reference actions on specific pages within the OAMP application.
The vulnerability exists due to insufficient input validation on specific pages in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server. A remote administrator can send a specially crafted HTTP request and modify certain configuration details of resources outside of their defined scope, which could result in a denial of service (DoS) condition.
Remediation
Install update from vendor's website.