Vulnerabilites related to Cisco - Cisco Meeting Management
cve-2024-20507
Vulnerability from cvelistv5
Published
2024-11-06 16:29
Modified
2024-11-06 17:05
Severity ?
EPSS score ?
Summary
A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.
This vulnerability is due to improper storage of sensitive information within the web-based management interface of an affected device. An attacker could exploit this vulnerability by logging in to the web-based management interface. A successful exploit could allow the attacker to view sensitive data that is stored on the affected device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Meeting Management |
Version: CMM3.4.0 Version: CMM3.2.0 Version: CMM2.9.1 Version: CMM2.9.0 Version: CMM3.1.0 Version: CMM3.5.0 Version: CMM3.6.0 Version: CMM3.6.1 Version: CMM3.7.0 Version: CMM3.8.0 Version: CMM3.9.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-20507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T17:05:07.038322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T17:05:16.145Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Meeting Management",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "CMM3.4.0"
},
{
"status": "affected",
"version": "CMM3.2.0"
},
{
"status": "affected",
"version": "CMM2.9.1"
},
{
"status": "affected",
"version": "CMM2.9.0"
},
{
"status": "affected",
"version": "CMM3.1.0"
},
{
"status": "affected",
"version": "CMM3.5.0"
},
{
"status": "affected",
"version": "CMM3.6.0"
},
{
"status": "affected",
"version": "CMM3.6.1"
},
{
"status": "affected",
"version": "CMM3.7.0"
},
{
"status": "affected",
"version": "CMM3.8.0"
},
{
"status": "affected",
"version": "CMM3.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the logging subsystem of Cisco Meeting Management could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.\r\n\r\nThis vulnerability is due to improper storage of sensitive information within the web-based management interface of an affected device. An attacker could exploit this vulnerability by logging in to the web-based management interface. A successful exploit could allow the attacker to view sensitive data that is stored on the affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T16:29:46.350Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cmm-info-disc-9ZEMAhGA",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-info-disc-9ZEMAhGA"
}
],
"source": {
"advisory": "cisco-sa-cmm-info-disc-9ZEMAhGA",
"defects": [
"CSCwm05372"
],
"discovery": "INTERNAL"
},
"title": "Cisco Meeting Management Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2024-20507",
"datePublished": "2024-11-06T16:29:46.350Z",
"dateReserved": "2023-11-08T15:08:07.688Z",
"dateUpdated": "2024-11-06T17:05:16.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2025-20156
Vulnerability from cvelistv5
Published
2025-01-22 16:21
Modified
2025-01-29 15:18
Severity ?
EPSS score ?
Summary
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device.
This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Meeting Management |
Version: CMM3.4.0 Version: CMM3.2.0 Version: CMM2.9.1 Version: CMM2.9.0 Version: CMM3.1.0 Version: CMM3.5.0 Version: CMM3.6.0 Version: CMM3.6.1 Version: CMM3.7.0 Version: CMM3.8.0 Version: CMM3.9.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-24T04:56:07.663388Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T15:18:06.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Meeting Management",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "CMM3.4.0"
},
{
"status": "affected",
"version": "CMM3.2.0"
},
{
"status": "affected",
"version": "CMM2.9.1"
},
{
"status": "affected",
"version": "CMM2.9.0"
},
{
"status": "affected",
"version": "CMM3.1.0"
},
{
"status": "affected",
"version": "CMM3.5.0"
},
{
"status": "affected",
"version": "CMM3.6.0"
},
{
"status": "affected",
"version": "CMM3.6.1"
},
{
"status": "affected",
"version": "CMM3.7.0"
},
{
"status": "affected",
"version": "CMM3.8.0"
},
{
"status": "affected",
"version": "CMM3.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device.\r\n\r\nThis vulnerability exists because proper authorization is not enforced upon\u0026nbsp;REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-274",
"description": "Improper Handling of Insufficient Privileges",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-22T16:21:20.333Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cmm-privesc-uy2Vf8pc",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-privesc-uy2Vf8pc"
},
{
"name": "ClamAV blog",
"url": "https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html"
},
{
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA"
}
],
"source": {
"advisory": "cisco-sa-cmm-privesc-uy2Vf8pc",
"defects": [
"CSCwi88558"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Meeting Management Client-Server Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20156",
"datePublished": "2025-01-22T16:21:20.333Z",
"dateReserved": "2024-10-10T19:15:13.216Z",
"dateUpdated": "2025-01-29T15:18:06.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}