CVE-2023-20062 Cisco Unified Intelligence Center Vulnerabilities

Medium 6.5 Published 3 Mar 2023 Updated 25 Oct 2024

Authenticated attackers can exploit SSRF and information disclosure flaws in Cisco Unified Intelligence Center to access sensitive data or internal resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20062?

CVE-2023-20062 is a medium-severity server-side request forgery vulnerability in Cisco Unified Intelligence Center, published on 3 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system. Cisco plans to release software updates that address these vulnerabilities.

Weakness: CWE-918, CWE-200

Which versions are affected by CVE-2023-20062?

It affects 4 products.

Products include Cisco Packaged Contact Center Enterprise, Cisco Unified Contact Center Enterprise, Cisco Unified Contact Center Express, Cisco Unified Intelligence Center.

How do I fix CVE-2023-20062?

No fix has been published for CVE-2023-20062 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-20062 being exploited?

There is no known exploitation of CVE-2023-20062 in the wild and no public exploit code.

Sources

Also known as GHSA-rpch-gp56-fxr3.