A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker…
Cisco · Cisco Unified Contact Center Enterprise
A flaw in the web-based management interface of Cisco Finesse, a component of Cisco Unified Contact Center Enterprise, stems from insufficient validation of user-supplied input in specific HTTP requests sent to the affected system. An unauthenticated attacker with network access can exploit it by sending a crafted HTTP request to the device, triggering a server-side request forgery that can expose limited sensitive information from services associated with the affected device, with no user interaction or configuration required.
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 20 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 4 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+4 days
- First seen exploitedVulnCheck KEV evidence+20 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.