CVE-2019-19866 - CVE House
Back to Database
Status published High CVE-2019-19866

Atos Unify OpenScape UC Web Client V9 before version V9...

Vulnerability Description

Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By iterating the value of conferenceId to getMailFunction in the JSON API, one can enumerate all conferences scheduled on the platform, with their numbers and access PINs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-19866

Credits & Attribution

No credits recorded in the NVD database.

References

More from atos

View All →
CVE-2022-46404
A command injection vulnerability has been identified in Atos Unify...
Critical 9.8
CVE-2022-36444
An issue was discovered in Atos Unify OpenScape SBC 9...
High 8.6
CVE-2019-19865
Atos Unify OpenScape UC Application V9 before version V9 R4.31.0...
Medium 6.1
CVE-2014-2651
Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has...
Critical 9.8
CVE-2014-2650
Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0...
Critical 9.8

Affected Vendor

Affected Software

unify openscape uc web client
Vulnerable Versions:
9.0, 10.0

Timeline

Official Publish: February 21st, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.