Vulnslist

Cisco Unified Contact Center Express Editor Information Disclosure Vulnerability

Cisco-SA-20130419-CVE-2013-1214 · Medium · Published 13 years ago · Updated 13 years ago

A vulnerability in the scripts editor software of the Cisco Unified Contact Center Express (Cisco Unified CCX) could allow an unauthenticated, remote attacker to have read access to scripts that are stored in the Cisco Unified CCX scripts repository. The vulnerability is due to improper privilege assignment when a user logs in to the Cisco Unified CCX Editor software with the anonymous option. An attacker could exploit this vulnerability by logging in to the Cisco Unified CCX Editor as an anonymous user and browsing the scripts repository directory. Alternatively, exploitation could occur if the attacker replicates the Cisco Unified CCX Editor behavior and connects to the Cisco Unified CCX. An exploit could allow the attacker to view any script in the scripts repository of the affected system. Cisco has confirmed the vulnerability in a security notice and software updates are available. It is likely that an attacker would need access to an internal, trusted network in which this device likely resides. This access requirement decreases the likelihood of a successful exploit. Customers are advised to review the bug report in the Vendor Announcements section for a current list of affected versions. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

CSAF Product Statuses

Related Products