PT-2016-4742 · Cisco · Cisco Finesse

Juliano Rizzo · Publicado 2016-05-05 · Atualizado 2016-12-01 · CVE-2016-1373

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Finesse versions 8.5(1) through 8.5(5) Cisco Finesse version 8.6(1) Cisco Finesse versions 9.0(1) through 9.0(2) Cisco Finesse version 9.1(1) Cisco Finesse version 9.1(1)SU1 Cisco Finesse version 9.1(1)SU1.1 Cisco Finesse versions 9.1(1)ES1 through 9.1(1)ES5 Cisco Finesse version 10.0(1) Cisco Finesse version 10.0(1)SU1 Cisco Finesse version 10.0(1)SU1.1 Cisco Finesse version 10.5(1) Cisco Finesse versions 10.5(1)ES1 through 10.5(1)ES4 Cisco Finesse version 10.5(1)SU1 Cisco Finesse version 10.5(1)SU1.1 Cisco Finesse version 10.5(1)SU1.7 Cisco Finesse version 10.6(1) Cisco Finesse version 10.6(1)SU1 Cisco Finesse version 10.6(1)SU2 Cisco Finesse version 11.0(1)

Description The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request. This is related to the gadgets-integration API in Cisco Finesse.

Recommendations For Cisco Finesse versions 8.5(1) through 8.5(5), update to a version outside of this range to resolve the issue. For Cisco Finesse version 8.6(1), update to a version outside of this range to resolve the issue. For Cisco Finesse versions 9.0(1) through 9.0(2), update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse versions 9.1(1)ES1 through 9.1(1)ES5, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1), update to a version outside of this range to resolve the issue. For Cisco Finesse versions 10.5(1)ES1 through 10.5(1)ES4, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1.7, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1)SU2, update to a version outside of this range to resolve the issue. For Cisco Finesse version 11.0(1), update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2016-1373

Produtos afetados

Cisco Finesse

Referências · 4

• http://securitytracker.com/id/1035756 · Nota
• https://osv.dev/vulnerability/CVE-2016-1373 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-finesse · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1373 · Nota de Segurança