CVE-2017-12287 — MEDIUM (4.3)

Vulnerability Description

A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to cause the CDB process on an affected system to restart unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability is due to incomplete input validation of URL requests by the REST API of the affected software. An attacker could exploit this vulnerability by sending a crafted URL to the REST API of the affected software on an affected system. A successful exploit could allow the attacker to cause the CDB process on the affected system to restart unexpectedly, resulting in a temporary DoS condition. Cisco Bug IDs: CSCve77571.

CVSS Score

4.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Cisco	Expressway	All versions
Cisco	Telepresence Conductor	All versions
Cisco	Telepresence Video Communication Server	All versions

Related Weaknesses (CWE)

CWE-20 CWE-399

References

http://www.securityfocus.com/bid/101525Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039626Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
http://www.securityfocus.com/bid/101525Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039626Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory

FAQ

What is CVE-2017-12287?

CVE-2017-12287 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, re...

How severe is CVE-2017-12287?

CVE-2017-12287 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-12287?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Expressway, Cisco Telepresence Conductor, Cisco Telepresence Video Communication Server.