Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Cisco Unified Communications tools permit password change via CSRF

CVE-2019-1915 · published 7 years ago
Summary

The web interfaces of Cisco Unified Communications Manager, its Session Management Edition, IM and Presence service, and Cisco Unity Connection do not adequately block cross‑site request forgery attacks. An attacker could trick a logged‑in user into clicking a malicious link, causing the user's password to be changed and giving the attacker unauthorized access. Apply the vendor's security updates and limit web access to trusted networks or users, and consider adding multi‑factor authentication for added protection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco unified_communications_manager 10.5\(2.10000.5\)
11.5\(1.10000.6\)
12.0\(1.10000.10\)
12.5\(1.10000.22\)
cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*
cisco unity_connection 11.5
12.0
12.5
14.0
cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*
cisco unified_communications_manager_im_and_presence_service 12.5\(1\)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\):*:*:*:*:*:*:*
Original advisory text
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM an...
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published2 Oct 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-1915 · NVD
Track software like this
Free during beta