CVE-2021-1246 Cisco Finesse OpenSocial Gadget Editor Unauthenticated Access Vulnerability
Unauthenticated attackers can access the OpenSocial Gadget Editor to view confidential information and create arbitrary XML files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-1246?
CVE-2021-1246 is a medium-severity missing authorization vulnerability in Cisco Unified Customer Voice Portal (CVP), published on 13 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Which versions are affected by CVE-2021-1246?
It affects 1 product.
Products include Cisco Finesse.
How do I fix CVE-2021-1246?
No fix has been published for CVE-2021-1246 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-1246 being exploited?
There is no known exploitation of CVE-2021-1246 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Customer Voice Portal (CVP)
Sources
Also known as GHSA-q5f8-cjfh-wg6r.