CVE-2023-20232

Summary

A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific API endpoint on the Unified CCX Finesse Portal. A successful exploit could allow the attacker to cause the internal WebProxy to redirect users to an attacker-controlled host.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Unified Contact Center Express8.5(1)affected
CiscoCisco Unified Contact Center Express9.0(2)SU3ES04affected
CiscoCisco Unified Contact Center Express10.0(1)SU1affected
CiscoCisco Unified Contact Center Express10.0(1)SU1ES04affected
CiscoCisco Unified Contact Center Express10.5(1)affected
CiscoCisco Unified Contact Center Express10.5(1)SU1affected
CiscoCisco Unified Contact Center Express10.5(1)SU1ES10affected
CiscoCisco Unified Contact Center Express10.6(1)affected
CiscoCisco Unified Contact Center Express10.6(1)SU1affected
CiscoCisco Unified Contact Center Express10.6(1)SU3affected
CiscoCisco Unified Contact Center Express10.6(1)SU2affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES03affected
CiscoCisco Unified Contact Center Express10.6(1)SU2ES04affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES02affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES01affected
CiscoCisco Unified Contact Center Express11.0(1)SU1affected
CiscoCisco Unified Contact Center Express11.0(1)SU1ES03affected
CiscoCisco Unified Contact Center Express11.0(1)SU1ES02affected
CiscoCisco Unified Contact Center Express11.5(1)SU1affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES02affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES01affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES03affected
CiscoCisco Unified Contact Center Express11.5(1)ES01affected
CiscoCisco Unified Contact Center Express12.0(1)affected
CiscoCisco Unified Contact Center Express12.0(1)ES01affected
CiscoCisco Unified Contact Center Express12.0(1)ES03affected
CiscoCisco Unified Contact Center Express12.0(1)ES04affected
CiscoCisco Unified Contact Center Express12.0(1)ES02affected
CiscoCisco Unified Contact Center Express12.5(1)affected
CiscoCisco Unified Contact Center Express12.5(1)SU1affected
CiscoCisco Unified Contact Center Express12.5(1)SU2affected
CiscoCisco Unified Contact Center Express12.5(1)SU3affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES03affected
CiscoCisco Unified Contact Center Express12.5(1)ES03affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES01affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES03affected
CiscoCisco Unified Contact Center Express12.5(1)ES01affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES01affected
CiscoCisco Unified Contact Center Express12.5(1)ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES01affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES04affected
CiscoCisco Unified Contact Center Express11.6(1)affected
CiscoCisco Unified Contact Center Express11.6(2)affected
CiscoCisco Unified Contact Center Express11.6(1)ES01affected
CiscoCisco Unified Contact Center Express11.6(2)ES06affected
CiscoCisco Unified Contact Center Express11.6(1)ES02affected
CiscoCisco Unified Contact Center Express11.6(2)ES01affected
CiscoCisco Unified Contact Center Express11.6(2)ES03affected
CiscoCisco Unified Contact Center Express11.6(2)ES07affected
CiscoCisco Unified Contact Center Express11.6(2)ES08affected
CiscoCisco Unified Contact Center Express11.6(2)ES02affected
CiscoCisco Unified Contact Center Express11.6(2)ES05affected
CiscoCisco Unified Contact Center Express11.6(2)ES04affected

Weaknesses

  • CWE-20: Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

References