CVE-2020-3402 Cisco Unified Customer Voice Portal Information Disclosure Vulnerability
Unauthenticated remote attackers can access sensitive information via unauthenticated RMI listeners in Cisco Unified Customer Voice Portal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3402?
CVE-2020-3402 is a medium-severity authentication bypass vulnerability in Cisco Unified IP Interactive Voice Response (IVR), published on 2 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not properly authenticated. An attacker could exploit this vulnerability by sending a crafted request to the affected listener. A successful exploit could allow the attacker to access sensitive information on an affected device.
Weakness: CWE-306
Which versions are affected by CVE-2020-3402?
It affects 1 product.
Products include Cisco Unified Customer Voice Portal.
How do I fix CVE-2020-3402?
No fix has been published for CVE-2020-3402 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-3402 being exploited?
There is no known exploitation of CVE-2020-3402 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified IP Interactive Voice Response (IVR)
Sources
Also known as GHSA-vg7g-wfjp-7wgp.