Improper input validation in Cisco Telepresence_video_communication_server_software
CVE-2015-4328
Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly checks for a user account's read-only attribute, which allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, as demons…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (47.9th percentile) — read the EPSS interpretation.
Affected products
- Cisco Telepresence_video_communication_server_software — versions x8.5.2
- N/a — versions n/a
Weakness classification (CWE)
References
- 1033329 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_SECTRACK)
- 76399 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_BID)
- 20150818 Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability (x_refsource_CISCO, vendor-advisory, Vendor Advisory)