PT-2016-6900 · Cisco · Cisco Unified Intelligence Center+1

Publicado 2016-10-05 · Atualizado 2017-07-30 · CVE-2016-6426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1) Unified Contact Center Express versions 10.0(1) through 11.0(1)

Description The issue allows remote attackers to create user accounts by visiting an unspecified web page. This is related to the j spring security switch user function.

Recommendations For Cisco Unified Intelligence Center (CUIC) versions 8.5.4 through 9.1(1), consider restricting access to the j spring security switch user function until a fix is available. For Unified Contact Center Express versions 10.0(1) through 11.0(1), restrict access to the vulnerable web page associated with the j spring security switch user function to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-6426

Produtos afetados

Cisco Unified Intelligence Center

Cisco Unified Contact Center Express

Referências · 5

• http://securityfocus.com/bid/93420 · Nota
• http://securitytracker.com/id/1036952 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6426 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6426 · Aviso do Fabricante