CVE-2016-6444 Cross-site request forgery in Cisco Meeting Server 1.8, 1.9, 2.0
An unauthenticated remote attacker can perform cross-site request forgery attacks against Web Bridge users in Cisco Meeting Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2016-6444?
CVE-2016-6444 is a high-severity vulnerability in Cisco Meeting Server 1.8, 1.9, 2.0, published on 27 Oct 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. More Information: CSCvb03308. Known Affected Releases: 1.8, 1.9, 2.0.
Weakness: CWE-352
Which versions are affected by CVE-2016-6444?
It affects 1 product.
Products include Cisco Meeting Server.
How do I fix CVE-2016-6444?
No fix has been published for CVE-2016-6444 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6444 being exploited?
There is no known exploitation of CVE-2016-6444 in the wild and no public exploit code.
Other vulnerabilities in Cisco Meeting Server 1.8, 1.9, 2.0
- CVE-2016-6448 Memory corruption in Cisco Meeting Server before 2.0.3 and Acano Server before 1.9.5
- CVE-2017-12249 Misconfiguration in Cisco Meeting Server
- CVE-2016-6445 Auth bypass in Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6
- CVE-2018-0439 Cisco Meeting Server Cross-Site Request Forgery Vulnerability
- CVE-2018-0262 Misconfiguration in Cisco Meeting Server
Sources
Also known as GHSA-gvgv-m2gj-339g.