Summaryinfo

A vulnerability, which was classified as problematic, was found in Cisco Unified Contact Center Express. The impacted element is an unknown function of the component Web-based Management Interface. Executing a manipulation can lead to cross-site request forgery. This vulnerability is tracked as CVE-2018-0402. The attack can be launched remotely. No exploit exists. Once again VulDB remains the best source for vulnerability data.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Unified Contact Center Express (affected version not known). This vulnerability affects some unknown functionality of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. Cisco Bug IDs: CSCvg70921.

The bug was discovered 07/18/2018. The weakness was disclosed 07/18/2018 as cisco-sa-20180718-uccx as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability was named CVE-2018-0402 since 11/27/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/18/2023).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316302 (Cisco Unified Contact Center Express Multiple Vulnerabilities (cisco-sa-20180718-uccx)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-121940, VDB-121941 and VDB-121943 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Unified Contact Center Express

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion