CVE-2019-1679

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Conductor versions prior to XC4.3.4 Cisco Expressway Series versions prior to XC4.3.4 Cisco TelePresence Video Communication Server versions prior to XC4.3.4

Description The issue is related to insufficient access controls for the REST API, allowing an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host, which is known as server-side request forgery (SSRF). This can be exploited by submitting a crafted HTTP request to the affected server.

Recommendations For Cisco TelePresence Conductor versions prior to XC4.3.4, update to version XC4.3.4 or later. For Cisco Expressway Series versions prior to XC4.3.4, update to version XC4.3.4 or later. For Cisco TelePresence Video Communication Server versions prior to XC4.3.4, update to version XC4.3.4 or later.