Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability
Cisco patched an authenticated SSRF flaw in Packaged CCE and Unified CCE that lets credentialed users send arbitrary network requests from affected devices.
A server-side request forgery vulnerability caused by improper input validation of specific HTTP requests affects Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. An authenticated, remote attacker with valid user credentials can send crafted HTTP requests to make the device issue arbitrary network requests. Cisco has released software updates; no exploitation is reported in the advisory.
- Improper input validation of specific HTTP requests enables SSRF
- Exploitation requires valid user credentials on the device
- Successful exploitation allows arbitrary requests sourced from the device
- Cisco has released fixed software
- Vendors
- Cisco
From the original article
A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.