漏洞标题
思科统一客户语音门户不安全的直接对象引用漏洞
漏洞描述信息
Cisco统一客户语音门户（CVP）的Operations, Administration, Maintenance and Provisioning（OAMP）OpsConsole Server中存在一个漏洞，该漏洞可能允许经过身份验证的远程攻击者在OAMP应用程序内的特定页面上执行不安全的直接对象引用操作。该漏洞是由于OAMP应用程序特定页面上输入验证不足造成的。攻击者可能通过身份验证Cisco统一CVP并向其发送构造的HTTP请求来利用此漏洞。成功的利用可能允许具有管理员或只读权限的攻击者了解其预期范围之外的信息。具有管理员权限的攻击者可能在其定义的范围之外修改某些资源的配置详细信息，从而导致拒绝服务（DoS）状况。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
漏洞类别
N/A
漏洞标题
Cisco Unified Customer Voice Portal Insecure Direct Object Reference Vulnerability
漏洞描述信息
A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to execute Insecure Direct Object Reference actions on specific pages within the OAMP application. The vulnerability is due to insufficient input validation on specific pages of the OAMP application. An attacker could exploit this vulnerability by authenticating to Cisco Unified CVP and sending crafted HTTP requests. A successful exploit could allow an attacker with administrator or read-only privileges to learn information outside of their expected scope. An attacker with administrator privileges could modify certain configuration details of resources outside of their defined scope, which could result in a denial of service (DoS) condition.
CVSS信息
N/A
漏洞类别
权限、特权和访问控制
漏洞标题
Cisco Unified Customer Voice Portal Software 权限许可和访问控制问题漏洞
漏洞描述信息
Cisco Unified Customer Voice Portal（CVP）是美国思科（Cisco）公司的一套用于提供语音和视频自助服务的统一通信系统。 Cisco Unified Customer Voice Portal (CVP) Software Release 11.6(1) ES-11之前版本和Release 12.0(1) ES-7之前版本中的Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsol
CVSS信息
N/A
漏洞类别
输入验证错误