CVE-2023-20232
Medium
Description
A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific API endpoint on the Unified CCX Finesse Portal. A successful exploit could allow the attacker to cause the internal WebProxy to redirect users to an attacker-controlled host.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Cisco Unified Contact Center Express
PublishedAug 16, 2023
First seenAug 16, 2023
Weakness typeCWE-20Improper input validation
How to fix
Update
- cisco unified_contact_center_express12.5\(1\)_su2_es05 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco unified_contact_center_express | v < 12.5\(1\)_su2_es05 | 12.5\(1\)_su2_es05 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.