PT-2021-1640 · Cisco · Cisco Virtualized Voice Browser+2

Published 2021-01-13 · Updated 2024-09-11 · CVE-2021-1246

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP (affected versions not specified)

Description: A vulnerability in the web management interface of the affected software could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL, such as a specifically designed "URL", allowing them to obtain access to a section of the interface. This could be used to obtain potentially confidential information and create arbitrary XML files using variables like xml file.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

XSS

Weakness Enumeration

CWE-306

CWE-79

Related Identifiers

BDU:2021-00296

CVE-2021-1246

Affected Products

Cisco Finesse

Cisco Unified Cvp

Cisco Virtualized Voice Browser

References · 6

• https://bdu.fstec.ru/vul/2021-00296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1246 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1246 · Vendor Advisory
• https://t.me/cvenotify/94223 · Telegram Post