{"containers": {"cna": {"affected": [{"product": "Cisco Meeting Server", "vendor": "n/a", "versions": [{"status": "affected", "version": "Cisco Meeting Server"}]}], "datePublic": "2017-02-21T00:00:00", "descriptions": [{"lang": "en", "value": "An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2."}], "problemTypes": [{"descriptions": [{"description": "HTTP Packet Processing Vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-24T12:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "1037834", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1037834"}, {"name": "96243", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96243"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2017-3837", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cisco Meeting Server", "version": {"version_data": [{"version_value": "Cisco Meeting Server"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "HTTP Packet Processing Vulnerability"}]}]}, "references": {"reference_data": [{"name": "1037834", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1037834"}, {"name": "96243", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96243"}, {"name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1", "refsource": "CONFIRM", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"}]}}}}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2017-3837", "datePublished": "2017-02-22T02:00:00", "dateReserved": "2016-12-21T00:00:00", "dateUpdated": "2017-07-24T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C48DC084-1DD2-4878-B1DB-1035CAE3B918", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "1CA9A904-9AB5-4757-ABD1-0F6F933799BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "8FA8A21E-97BA-4326-9F7B-FCBD480134EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "1E6FA3F5-752D-45AB-A8CB-6488F409D933", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4B80C9BA-07EC-4183-9AAD-3229913C9FD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "9B1895DF-AFB1-4B6E-A42C-38F7E19A5842", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "3BC4BC50-1D9C-42F3-A88F-FE1E2C8A6C76", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "FA671C18-10F2-4A45-8D1C-BF460ECA84B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "F618372C-0913-4773-9267-A835F31FA776", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "B310B39B-7D5D-4533-9FE6-5F47985E35B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "B2720CCF-3B73-4268-94C7-9AE3D1ECAC75", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2."}, {"lang": "es", "value": "Una vulnerabilidad de HTTP Packet Processing en la interfaz Web Bridge de Cisco Meeting Server (CMS), anteriormente Acano Conferencing Server, podr\u00eda permitir a un atacante remoto autenticado recuperar contenidos de la memoria, lo que podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n confidencial. Adem\u00e1s, el atacante podr\u00eda provocar potencialmente que la aplicaci\u00f3n se bloqueara de forma inesperada, resultando en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). El atacante necesitar\u00eda estar autenticado y tener una sesi\u00f3n validada con Web Bridge. Productos Afectados: Esta vulnerabilidad afecta a lanzamientos de software Cisco Meeting Server anteriores a 2.1.2. Este producto fue previamente conocido como Acano Conferencing Server. M\u00e1s Informaci\u00f3n: CSCvc89551. Lanzamientos Afectados Conocidos: 2.0 2.0.7 2.1. Lanzamientos Reparados Conocidos: 2.1.2."}], "id": "CVE-2017-3837", "lastModified": "2017-07-25T01:29:09.187", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-22T02:59:00.450", "references": [{"source": "ykramarz@cisco.com", "url": "http://www.securityfocus.com/bid/96243"}, {"source": "ykramarz@cisco.com", "url": "http://www.securitytracker.com/id/1037834"}, {"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}