CVE-2022-20768 (CNNVD-202207-525)
中文标题:
Cisco TelePresence Collaboration Endpoint Software 和 RoomOS Software 日志信息泄露漏洞
英文标题:
Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability
漏洞描述
中文描述:
Cisco RoomOS Software和Cisco TelePresence Collaboration Endpoint Software都是美国思科（Cisco）公司的产品。Cisco RoomOS Software是一套用于Cisco设备的自动管理软件。该软件主要用于升级、管理Cisco设备的主板固件。Cisco TelePresence Collaboration Endpoint Software是一套协作终端软件。 Cisco TelePresence Collaboration Endpoint 和 RoomOS Software 存在日志信息泄露漏洞。经过身份验证的远程攻击者利用该漏洞可以在受影响的系统上以明文形式查看敏感信息。
英文描述:
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to access confidential information, some of which may contain personally identifiable information (PII). Note: To access the logs that are stored in the RoomOS Cloud, an attacker would need valid Administrator-level credentials.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco RoomOS Software | n/a | - | - |
cpe:2.3:a:cisco:cisco_roomos_software:n_a:*:*:*:*:*:*:*
|
| cisco | telepresence_collaboration_endpoint | * | - | - |
cpe:2.3:a:cisco:telepresence_collaboration_endpoint:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-20768 |
2025-11-11 15:21:15 | 2025-11-11 07:37:15 |
| NVD | nvd_CVE-2022-20768 |
2025-11-11 14:58:20 | 2025-11-11 07:45:32 |
| CNNVD | cnnvd_CNNVD-202207-525 |
2025-11-11 15:10:56 | 2025-11-11 07:57:24 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 日志信息泄露
- cnnvd_id: 未提取 -> CNNVD-202207-525
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']