Cisco Finesse Directory Read Vulnerability

A vulnerability in the web interface of Cisco Finesse could allow an unauthenticated, remote attacker to read the contents of a directory on the server.

The vulnerability is due to insufficient access controls on directory access. An attacker could exploit this vulnerability by visiting a URL that points to an open directory. An exploit could allow the attacker to read the contents of the accessed directory.

Cisco has confirmed this vulnerability in a security notice and released software updates.

To exploit this vulnerability, it is likely an attacker would need access to trusted, internal networks in which the targeted device may reside. This access requirement decreases the likelihood of a successful exploit.