PT-2022-1440 · Cisco · Cisco Unified Contact Center Management Portal+1

Published 2022-01-12 · Updated 2022-01-14 · CVE-2022-20658

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Management Portal (Unified CCMP) versions prior to 11.6.1 ES17 Cisco Unified Contact Center Management Portal (Unified CCMP) versions prior to 12.0.1 ES5 Cisco Unified Contact Center Management Portal (Unified CCMP) versions prior to 12.5.1 ES5 Cisco Unified Contact Center Domain Manager (Unified CCDM) versions prior to 11.6.1 ES17 Cisco Unified Contact Center Domain Manager (Unified CCDM) versions prior to 12.0.1 ES5 Cisco Unified Contact Center Domain Manager (Unified CCDM) versions prior to 12.5.1 ES5

Description A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to Administrator. This vulnerability is due to the lack of server-side validation of user permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to a vulnerable system. A successful exploit could allow the attacker to create Administrator accounts, which would grant access to and modification of telephony and user resources across all the Unified platforms associated with the vulnerable Cisco Unified CCMP.

Recommendations For versions prior to 11.6.1 ES17, update to version 11.6.1 ES17 or later. For versions prior to 12.0.1 ES5, update to version 12.0.1 ES5 or later. For versions prior to 12.5.1 ES5, update to version 12.5.1 ES5 or later. As a temporary workaround, consider restricting access to the vulnerable web-based management interface until a patch is applied. Avoid using the vulnerable interface to create new Administrator accounts until the issue is resolved.

Fix

Weakness Enumeration

CWE-669

CWE-602

Related Identifiers

BDU:2022-00543

CVE-2022-20658

Affected Products

Cisco Unified Contact Center Domain Manager

Cisco Unified Contact Center Management Portal

References · 7

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmp-priv-esc-JzhTFLm4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00543 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20658 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20658 · Vendor Advisory
• https://t.me/thehackernews/1790 · Telegram Post
• https://t.me/true_secator/2519 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022012421 · Note