CVE-2019-1877CWE-200

Cisco Enterprise Chat and Email Attachment Download Vulnerability

Medium · published November 5, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
72.9
In the wild
Unconfirmed
What it is

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01437 · 72.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-11-05T19:25Z
EPSS history
Timeline
  • 05 NOV 19:25Z
    Cisco Enterprise Chat and Email Attachment Download Vulnerability
    cvelistv5