{"id":"CVE-2019-15272","state":"PUBLISHED","title":"Cisco Unified Communications Manager Security Bypass Vulnerability","description":"A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HTTP methods. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to gain unauthorized access to the system.","publishedAt":"2019-10-02T19:06:55.659Z","updatedAt":"2024-11-19T18:53:14.532Z","severity":{"score":6.5,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco Unified Communications Manager"],"affected":[{"vendor":"Cisco","product":"Cisco Unified Communications Manager","versions":[{"version":"unspecified","status":"affected","lessThan":"n/a","versionType":"custom"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-ucm-secbypass"],"weaknesses":["CWE-264"],"ingestedAt":"2026-10-29T19:45:33.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/15xxx/CVE-2019-15272.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-15272","state":"PUBLISHED","datePublished":"2019-10-02T19:06:55.659Z","dateUpdated":"2024-11-19T18:53:14.532Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2019-08-20T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco Unified Communications Manager Security Bypass Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HTTP methods. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to gain unauthorized access to the system."}],"affected":[{"vendor":"Cisco","product":"Cisco Unified Communications Manager","versions":[{"version":"unspecified","status":"affected","lessThan":"n/a","versionType":"custom"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-ucm-secbypass","name":"20191002 Cisco Unified Communications Manager Security Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-264","description":"CWE-264","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2019-10-02T19:06:55.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2019-10-02T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-20191002-ucm-secbypass","defect":[["CSCvp14434"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2019-10-02T16:00:00-0700","ID":"CVE-2019-15272","STATE":"PUBLIC","TITLE":"Cisco Unified Communications Manager Security Bypass Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Unified Communications Manager","version":{"version_data":[{"affected":"<","version_affected":"<","version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HTTP methods. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to gain unauthorized access to the system."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"6.5","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-264"}]}]},"references":{"reference_data":[{"name":"20191002 Cisco Unified Communications Manager Security Bypass Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-ucm-secbypass"}]},"source":{"advisory":"cisco-sa-20191002-ucm-secbypass","defect":[["CSCvp14434"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-ucm-secbypass","name":"20191002 Cisco Unified Communications Manager Security Bypass Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T00:42:03.947Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-19T17:22:36.861839Z","id":"CVE-2019-15272","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-19T18:53:14.532Z"}}]}}}