CVE-2017-3837 Information disclosure in Cisco Meeting Server

High 8.1 Published 22 Feb 2017 Updated 5 Aug 2024

Authenticated attackers can retrieve memory contents and cause denial of service in Cisco Meeting Server via HTTP packet processing flaws.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-3837?

CVE-2017-3837 is a high-severity vulnerability in Cisco Meeting Server, published on 22 Feb 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.

Weakness: CWE-20

Which versions are affected by CVE-2017-3837?

It affects 1 product.

Products include Cisco Meeting Server.

How do I fix CVE-2017-3837?

No fix has been published for CVE-2017-3837 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-3837 being exploited?

There is no known exploitation of CVE-2017-3837 in the wild and no public exploit code.

Sources

Also known as GHSA-v3v8-cv78-pwpq.