Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with their numbers and access PINs.
References
| Link | Resource |
|---|---|
| https://networks.unify.com/security/advisories/OBSO-2002-01.pdf | Vendor Advisory |
| https://unify.com/en/support/security-advisories | Vendor Advisory |
| https://networks.unify.com/security/advisories/OBSO-2002-01.pdf | Vendor Advisory |
| https://unify.com/en/support/security-advisories | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://networks.unify.com/security/advisories/OBSO-2002-01.pdf - Vendor Advisory | |
| References | () https://unify.com/en/support/security-advisories - Vendor Advisory |
Information
Published : 2020-02-21 16:15
Updated : 2024-11-21 04:35
NVD link : CVE-2019-19866
Mitre link : CVE-2019-19866
CVE.ORG link : CVE-2019-19866
JSON object : View
Products Affected
atos
- unify_openscape_uc_web_client
CWE
CWE-639
Authorization Bypass Through User-Controlled Key