Cisco TelePresence Collaboration Endpoint ソフトウェアおよび Cisco RoomOS ソフトウェアにおけるパストラバーサルの脆弱性
| Title |
Cisco TelePresence Collaboration Endpoint ソフトウェアおよび Cisco RoomOS ソフトウェアにおけるパストラバーサルの脆弱性
|
| Summary |
Cisco TelePresence Collaboration Endpoint (CE) ソフトウェアおよび Cisco RoomOS ソフトウェアには、パストラバーサルの脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 5, 2021, midnight |
| Registration Date |
Jan. 13, 2022, 5:59 p.m. |
| Last Update |
Jan. 13, 2022, 5:59 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
|
CVSS2.0 : 警告
|
| Score |
4
|
| Vector |
AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected System
| シスコシステムズ |
|
Cisco RoomOS
|
|
Cisco TelePresence Collaboration Endpoint
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2022年01月13日]
掲載 |
Jan. 13, 2022, 5:59 p.m. |
NVD Vulnerability Information
CVE-2021-1532
| Summary |
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation of command arguments. An attacker could exploit this vulnerability by sending a crafted command request to the xAPI. A successful exploit could allow the attacker to read the contents of any file that is located on the device filesystem.
|
| Publication Date |
May 6, 2021, 10:15 p.m. |
| Registration Date |
May 7, 2021, 10 a.m. |
| Last Update |
Nov. 21, 2024, 2:44 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:cisco:roomos:*:*:*:*:*:*:*:* |
|
|
|
10.3.1 |
| cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:* |
9.15.0.11 |
|
|
9.15.3 |
| cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:* |
|
|
|
9.14.6 |
Related information, measures and tools
Common Vulnerabilities List