PT-2017-17196 · Cisco · Cisco Unified Contact Center Enterprise

Publicado 2017-05-03 · Atualizado 2017-07-11 · CVE-2017-6626

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Enterprise (UCCE) versions 11.5(1) through 11.6(1)

Description A vulnerability exists due to an undocumented, hard-coded password for a user account. This allows an unauthenticated, remote attacker to retrieve information from agents using the Finesse Desktop by subscribing to the Finesse Notification Service. The attacker can receive notifications when an agent signs in or out, when information about an agent changes, or when an agent's state changes.

Recommendations For versions 11.5(1) and 11.6(1), update the system to remove the hard-coded password and ensure that all user accounts have secure, unique passwords. As a temporary workaround, consider restricting access to the Finesse Notification Service to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6626

Produtos afetados

Cisco Unified Contact Center Enterprise

Referências · 5

• http://securityfocus.com/bid/98291 · Nota
• https://osv.dev/vulnerability/CVE-2017-6626 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6626 · Nota de Segurança
• http://securitytracker.com/id/1038396 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-finesse-ucce · Aviso do Fabricante