Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Unified Contact Center Express (UCCX), Cisco Unified Contact Center Enterprise und Cisco Unified Intelligence Center ausnutzen, um Administratorrechte zu erlangen beliebigen Code auszuführen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
Product
Cisco Unified Contact Center Express (UCCX) ist die Kontaktverwaltung für Cisco Unified Communications.
Cisco Unified Contact Center Enterprise kombiniert Mehrkanal-Rufverteilung (ACD) mit IP-Telefonie in einer einheitlichen Lösung.
Cisco Unified Intelligence Center ist eine webbasierte Berichtsanwendung für Contact Center.
Vulnerabilities 4
-
Medium 6.5
Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit…
-
Medium 6.5
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could explo…
-
Medium 4.9
Cisco Unified Contact Center Express Arbitrary File Download Vulnerability
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features.…
-
Medium 4.3
Cisco Unified Intelligence Center API Information Disclosure Vulnerability
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoi…
Revision history
-
#2
Neue gefixte Version von Cisco aufgenommen
-
#1
Initiale Fassung
References
-
Cisco Security Advisory cisco-sa-cc-mult-vuln-gK4TFXSn vom 2025-11-05
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
-
Cisco Security Advisory cisco-sa-cc-mult-vuln-gK4TFXSn vom 2025-11-18
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn