1. CVE-Search
  2. CVE-2019-1763
ID CVE-2019-1763
Summary A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to critical services and cause a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.
References
Vulnerable Configurations
  • cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_phone_8821_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*
    cpe:2.3:h:cisco:ip_phone_8821:-:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_phone_8821-ex_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*
    cpe:2.3:h:cisco:ip_phone_8821-ex:-:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.2\(2\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.2\(2\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.3\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.3\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.3\(2\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:10.3\(2\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.0\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.0\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.5\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.5\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.5\(1\)sr1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.5\(1\)sr1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.7\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:11.7\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.0\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.0\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.0\(1\)sr1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.0\(1\)sr1:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.1\(1\):*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.1\(1\):*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.1\(1\)sr1:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_conference_phone_8832_firmware:12.1\(1\)sr1:*:*:*:*:*:*:*
  • cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:*
    cpe:2.3:h:cisco:ip_conference_phone_8832:-:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ip_phone_8800_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*
    cpe:2.3:h:cisco:ip_phone_8800:-:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 08-10-2020 - 19:58)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
cisco 20190320 Cisco IP Phone 8800 Series Authorization Bypass Vulnerability
Last major update 08-10-2020 - 19:58
Published 22-03-2019 - 20:29
Last modified 08-10-2020 - 19:58
Back to Top