CVE-2017-12224 Auth bypass in Cisco Meeting Server
Authenticated attackers can bypass guest access restrictions to join meetings via hyperlinks in Cisco Meeting Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-12224?
CVE-2017-12224 is a medium-severity authentication bypass vulnerability in Cisco Meeting Server, published on 7 Sep 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the configuration setting Guest access via hyperlinks, which should allow the administrative user to prevent guest users from using hyperlinks to connect to meetings. An attacker could exploit this vulnerability by using a crafted hyperlink to connect to a meeting. An exploit could allow the attacker to connect directly to the meeting with a hyperlink, even though access should be denied. The attacker would still require a valid hyperlink and encoded secret identifier to be connected. Cisco Bug IDs: CSCve20873.
Weakness: CWE-200
Which versions are affected by CVE-2017-12224?
It affects 1 product.
Products include Cisco Meeting Server.
How do I fix CVE-2017-12224?
No fix has been published for CVE-2017-12224 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-12224 being exploited?
There is no known exploitation of CVE-2017-12224 in the wild and no public exploit code.
Other vulnerabilities in Cisco Meeting Server
- CVE-2016-6448 Memory corruption in Cisco Meeting Server before 2.0.3 and Acano Server before 1.9.5
- CVE-2017-12249 Misconfiguration in Cisco Meeting Server
- CVE-2016-6445 Auth bypass in Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6
- CVE-2018-0439 Cisco Meeting Server Cross-Site Request Forgery Vulnerability
- CVE-2016-6444 Cross-site request forgery in Cisco Meeting Server 1.8, 1.9, 2.0
Sources
Also known as GHSA-wq4v-hm3c-w6rg.