CSRF in Cisco Telepresence Video Communication Server (Vcs) Expressway
CVE-2022-20853
A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerabil…
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.006 (70.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H.
Affected products
- Cisco Telepresence Video Communication Server (Vcs) Expressway — versions X8.11.2, X8.6, X8.11.3
Weakness classification (CWE)
References
- cisco-sa-expressway-csrf-sqpsSfY6
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8</a></p><p><strong>Attention</strong>: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see <a href="https://www.cisco.com/c/en/us/products/security/secure-names.html">Meet Cisco Secure
Frequently asked questions
- What is CVE-2022-20853?
- CVE-2022-20853 is a high-severity vulnerability in Cisco Telepresence Video Communication Server (Vcs) Expressway, classified under Cross-Site Request Forgery (CSRF). CVSS score: 7.4/10. Published 2024-11-15.
- How severe is CVE-2022-20853?
- High severity. CVSS v3 base score is 7.4 out of 10.