Description
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system.
This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Unified Contact Center Enterprise | N/A | — |
| Cisco | Cisco Unified Contact Center Express | N/A | — |
| Cisco | Cisco Finesse | 12.6(2), 12.6(2)ES1, 12.6(2)ES2 | — |
| Cisco | Cisco Packaged Contact Center Enterprise | N/A | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
3zz4t/CVE-2024-20404 ★ 2 · Jun 9, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Cisco Finesse - Server-Side Request Forgery (SSRF) http/cves/2024/CVE-2024-20404.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-1303 Cisco Finesse: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 5, 2024