Severity
Medium
Analysis Summary
CVE-2023-20062 CVSS:5
Cisco Unified Intelligence Center is vulnerable to server-side request forgery, caused by improper input validation for specific HTTP requests. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to conduct SSRF attack to send arbitrary network requests.
CVE-2023-20061 CVSS:6.5
Cisco Unified Intelligence Center could allow a remote authetnicated attacker to obtain sensitive information, caused by excessive verbosity in a specific REST API output. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Impact
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2023-20062
- CVE-2023-20061
Affected Vendors
Cisco
Affected Products
- Cisco Unified Contact Center Enterprise
- Cisco Unified Contact Center Express.
- Cisco Unified Intelligence Center (CUIC)
- Cisco Packaged Contact Center Enterprise
Remediation
Refer to Cisco Security Advisory for patch, upgrade or suggested workaround information.