Lucene search

CiscoCVE-2024-20404

HistoryJun 05, 2024 - 5:15 p.m.

CVE-2024-20404

2024-06-0517:15:11

CWE-918

cisco

web.nvd.nist.gov

cisco finesse

vulnerability

unauthenticated

remote attacker

ssrf attack

insufficient validation

user-supplied input

http request

sensitive information

nvd

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system.

This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.

Affected configurations

Nvd

Node

ciscofinesseRange<11.6\(1\)

ciscofinesseMatch11.6\(1\)-

ciscofinesseMatch11.6\(1\)es4

ciscofinesseMatch11.6\(1\)es5

ciscofinesseMatch11.6\(1\)es6

ciscofinesseMatch11.6\(1\)es7

ciscofinesseMatch11.6\(1\)es8

ciscofinesseMatch12.6\(2\)-

ciscofinesseMatch12.6\(2\)es01

ciscofinesseMatch12.6\(2\)es02

VendorProductVersionCPE
ciscofinesse*cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):-:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):es4:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):es5:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):es6:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):es7:*:*:*:*:*:*
ciscofinesse11.6(1)cpe:2.3:a:cisco:finesse:11.6\(1\):es8:*:*:*:*:*:*
ciscofinesse12.6(2)cpe:2.3:a:cisco:finesse:12.6\(2\):-:*:*:*:*:*:*
ciscofinesse12.6(2)cpe:2.3:a:cisco:finesse:12.6\(2\):es01:*:*:*:*:*:*
ciscofinesse12.6(2)cpe:2.3:a:cisco:finesse:12.6\(2\):es02:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	finesse	*	cpe:2.3:a:cisco:finesse::::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):-::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):es4::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):es5::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):es6::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):es7::::::
cisco	finesse	11.6(1)	cpe:2.3:a:cisco:finesse:11.6\(1\):es8::::::
cisco	finesse	12.6(2)	cpe:2.3:a:cisco:finesse:12.6\(2\):-::::::
cisco	finesse	12.6(2)	cpe:2.3:a:cisco:finesse:12.6\(2\):es01::::::
cisco	finesse	12.6(2)	cpe:2.3:a:cisco:finesse:12.6\(2\):es02::::::

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Unified Contact Center Enterprise",
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Unified Contact Center Express",
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Finesse",
    "versions": [
      {
        "version": "12.6(2)",
        "status": "affected"
      },
      {
        "version": "12.6(2)ES1",
        "status": "affected"
      },
      {
        "version": "12.6(2)ES2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Packaged Contact Center Enterprise",
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-rfi-Um7wT8Ew

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2024-20404