Cisco IP Phones 8800 Series Cross-Site Request Forgery (CVE-2019-1764)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502143);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/18");

  script_cve_id("CVE-2019-1764");

  script_name(english:"Cisco IP Phones 8800 Series Cross-Site Request Forgery (CVE-2019-1764)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web-based management interface of Session
Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series
could allow an unauthenticated, remote attacker to conduct a cross-
site request forgery (CSRF) attack. The vulnerability is due to
insufficient CSRF protections for the web-based management interface
of an affected device. An attacker could exploit this vulnerability by
persuading an authenticated user of the interface to follow a crafted
link. A successful exploit could allow the attacker to perform
arbitrary actions on a targeted device via a web browser and with the
privileges of the user. This vulnerability affects Cisco IP Phone 8800
Series products running a SIP Software release prior to 11.0(5) for
Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP
Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco
IP Conference Phone 8831 is not affected.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-csrf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5ed64213");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1764");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(352);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/03/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8821-ex_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8821_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ip_phone_8800_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:ip_phone_8821_firmware" :
        {"versionEndExcluding" : "11.0(5)", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8821-ex_firmware" :
        {"versionEndExcluding" : "11.0(5)", "family" : "CiscoIPPhones"},
    "cpe:/o:cisco:ip_phone_8800_series_firmware" :
        {"versionEndExcluding" : "12.5(1)sr1", "family" : "CiscoIPPhones"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);