Lucene search

CiscoCVE-2022-20953

HistoryOct 26, 2022 - 3:15 p.m.

CVE-2022-20953

2022-10-2615:15:14

CWE-200

CWE-22

cisco

web.nvd.nist.gov

cisco

telepresence

collaboration endpoint

ce software

roomos software

path traversal attacks

sensitive data exposure

cve-2022-20953

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

9.9%

JSON

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

Nvd

Node

ciscotelepresence_collaboration_endpointRange<10.19.1

ciscoroomosMatch-

VendorProductVersionCPE
ciscotelepresence_collaboration_endpoint*cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:*
ciscoroomos-cpe:2.3:o:cisco:roomos:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	telepresence_collaboration_endpoint	*	cpe:2.3:a:cisco:telepresence_collaboration_endpoint::::::::
cisco	roomos	-	cpe:2.3:o:cisco:roomos:-:::::::*

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco RoomOS Software",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-trav-beFvCcyu

Social References

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

9.9%

JSON

Related for CVE-2022-20953