PT-2016-4742 · Cisco · Cisco Finesse

Juliano Rizzo · Published 2016-05-05 · Updated 2016-12-01 · CVE-2016-1373

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Finesse versions 8.5(1) through 8.5(5) Cisco Finesse version 8.6(1) Cisco Finesse versions 9.0(1) through 9.0(2) Cisco Finesse version 9.1(1) Cisco Finesse version 9.1(1)SU1 Cisco Finesse version 9.1(1)SU1.1 Cisco Finesse versions 9.1(1)ES1 through 9.1(1)ES5 Cisco Finesse version 10.0(1) Cisco Finesse version 10.0(1)SU1 Cisco Finesse version 10.0(1)SU1.1 Cisco Finesse version 10.5(1) Cisco Finesse versions 10.5(1)ES1 through 10.5(1)ES4 Cisco Finesse version 10.5(1)SU1 Cisco Finesse version 10.5(1)SU1.1 Cisco Finesse version 10.5(1)SU1.7 Cisco Finesse version 10.6(1) Cisco Finesse version 10.6(1)SU1 Cisco Finesse version 10.6(1)SU2 Cisco Finesse version 11.0(1)

Description The issue allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request. This is related to the gadgets-integration API in Cisco Finesse.

Recommendations For Cisco Finesse versions 8.5(1) through 8.5(5), update to a version outside of this range to resolve the issue. For Cisco Finesse version 8.6(1), update to a version outside of this range to resolve the issue. For Cisco Finesse versions 9.0(1) through 9.0(2), update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 9.1(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse versions 9.1(1)ES1 through 9.1(1)ES5, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.0(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1), update to a version outside of this range to resolve the issue. For Cisco Finesse versions 10.5(1)ES1 through 10.5(1)ES4, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1.1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.5(1)SU1.7, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1), update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1)SU1, update to a version outside of this range to resolve the issue. For Cisco Finesse version 10.6(1)SU2, update to a version outside of this range to resolve the issue. For Cisco Finesse version 11.0(1), update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2016-1373

Affected Products

Cisco Finesse

References · 4

• https://osv.dev/vulnerability/CVE-2016-1373 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-finesse · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1373 · Security Note
• http://securitytracker.com/id/1035756 · Note