This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Cisco Finesse fixes 2 vulnerabilities
Cisco is fixing 2 vulnerabilities in Cisco Finesse in version 12.6(2) ES03. The vulnerabilities also affect products directly associated with Cisco Finesse (Packaged Contact Center Enterprise, Unified Contact Center Enterprise, Unified Contact Center Express and Unified Intelligence Center) [1].
An unauthenticated remote attacker can gain unauthorized access to sensitive information in the web interface using specially crafted HTTP requests [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20404 at cve.org, NVD
- CWE-918 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 6. 2024.
An unauthenticated remote attacker can carry out a stored XSS attack by planting a specially crafted file [1].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20405 at cve.org, NVD
- CWE-79 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 6. 2024.
By CESNET, z.s.p.o. Martin Krajči on 6. 6. 2024.