PT-2020-1745 · Cisco · Cisco Unified Contact Center Express

Published 2020-02-19 · Updated 2021-05-14 · CVE-2019-1888

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Express (affected versions not specified)

Description A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express could allow an authenticated, remote attacker to upload arbitrary files and execute commands on the underlying operating system. To exploit this issue, an attacker needs valid Administrator credentials. The vulnerability is due to insufficient restrictions for the content uploaded to an affected system. An attacker could exploit this vulnerability by uploading arbitrary files containing operating system commands that will be executed by an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web interface and then elevate their privileges to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2020-00985

CVE-2019-1888

Affected Products

Cisco Unified Contact Center Express

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-privesc-Zd7bvwyf · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00985 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1888 · Security Note
• https://t.me/ckure/7949 · Telegram Post
• https://t.me/cibsecurity/14823 · Telegram Post