Riskcovery

CVE-2023-20002

State
Published
Severity
4.4 Medium
Published
Jan 19, 2023
Updated
Aug 2, 2024
Reserved
Oct 27, 2022

Read the record on cve.org

Description

A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a user of the web application. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected system.

Scores

CVSSScoreVectorSource
3.14.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
Cisco RoomOS SoftwareCisco
  • RoomOS 10.3.2.0Affected
  • RoomOS 10.3.4.0Affected
  • RoomOS 10.8.2.5Affected
  • RoomOS 10.11.5.2Affected
  • RoomOS 10.8.4.0Affected
  • RoomOS 10.11.3.0Affected
  • RoomOS 10.15.3.0Affected
Cisco TelePresence Endpoint Software (TC/CE)Cisco
  • CE9.0.1Affected
  • CE9.1.1Affected
  • CE9.1.2Affected
  • CE9.1.3Affected
  • CE9.1.4Affected
  • CE9.1.5Affected
  • CE9.1.6Affected
  • CE9.10.1Affected
  • CE9.10.2Affected
  • CE9.10.3Affected
  • CE9.12.4Affected
  • CE9.12.5Affected
  • CE9.12.3Affected
  • CE9.13.0Affected
  • CE9.13.1Affected
  • CE9.13.3Affected
  • CE9.13.2Affected
  • CE9.2.1Affected
  • CE9.2.2Affected
  • CE9.2.3Affected
  • CE9.2.4Affected
  • CE9.9.3Affected
  • CE9.9.4Affected
  • CE9.14.3Affected
  • CE9.14.5Affected
  • and 16 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.