Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability
Cisco-SA-20140227-CVE-2014-0745 · Medium · Published · Updated
A vulnerability in the Cisco Unified Serviceability component of Cisco Unified Contact Center Express (Cisco Unified CCX) could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing an authenticated Unified CCX user to click a malicious link. An exploit could allow the attacker to perform actions in the Cisco Unified Serviceability pages with the privileges of the authenticated Unified CCX user. Cisco has confirmed the vulnerability in a security notice; however, software updates are not available. To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.
Administrators are advised to contact the vendor regarding future updates and releases.
Users are advised not to open email messages from suspicious or unrecognized sources. If users cannot verify that links or attachments included in email messages are safe, they are advised not to open them.