CVE-2019-12633 Cisco Unified Contact Center Express Request Processing Server-Side Request Forgery Vulnerability

Medium 5.3 Published 5 Sep 2019 Updated 19 Nov 2024

Unauthenticated attackers can exploit improper input validation to perform server-side request forgery, bypassing access controls to access internal systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12633?

CVE-2019-12633 is a medium-severity server-side request forgery vulnerability in Cisco Unified Contact Center Express, published on 5 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. The vulnerability is due to improper validation of user-supplied input on the affected system. An attacker could exploit this vulnerability by sending the user of the web application a crafted request. If the request is processed, the attacker could access the system and perform unauthorized actions.

Weakness: CWE-918, CWE-20

Which versions are affected by CVE-2019-12633?

It affects 1 product.

Products include Cisco Unified Contact Center Express.

How do I fix CVE-2019-12633?

No fix has been published for CVE-2019-12633 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-12633 being exploited?

There is no known exploitation of CVE-2019-12633 in the wild and no public exploit code.

Sources

Also known as GHSA-6m2f-gr3g-wqw2.