Cisco Finesse Vulnerabilities Let Attackers Perform Stored XSS Attack
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
Cisco has issued a security advisory detailing multiple vulnerabilities in Cisco Finesse’s web-based management interface.
These vulnerabilities, identified as CVE-2024-20404 and CVE-2024-20405, could allow unauthenticated, remote attackers to perform a stored cross-site scripting (XSS) attack.
The vulnerabilities in question involve a remote file inclusion (RFI) vulnerability and a server-side request forgery (SSRF) attack.
Specifically, the stored XSS attack can be executed by exploiting the RFI vulnerability, while the SSRF attack can be conducted on an affected system through Cisco Finesse’s web-based management interface.
Cisco has classified these vulnerabilities’ Security Impact Rating (SIR) as Medium, primarily due to the limited scope of information accessible to the attacker.
The Common Vulnerability Scoring System (CVSS) base score for these vulnerabilities is 7.2, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
This indicates that the vulnerabilities are network exploitable, require low attack complexity, and do not require privileges or user interaction but have a limited impact on confidentiality and integrity.
Affected Products & Mitigation
At the time of publication, the vulnerabilities affected the following Cisco Finesse releases:
Cisco has released software updates to address these vulnerabilities. Users are advised to migrate to the fixed releases to mitigate the risks associated with these vulnerabilities. The first fixed releases are:
No workarounds are available for these vulnerabilities, making it crucial for users to apply the provided updates.
These vulnerabilities highlight the importance of keeping software up to date and applying security patches promptly. Cisco’s proactive release of updates aims to protect users from potential exploitation by malicious actors. Users can refer to the official Cisco Security Advisory here for more detailed information.
#Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
Cisco Finesse Vulnerabilities Let Attackers Perform Stored XSS Attack
Author: Guru BaranCisco has issued a security advisory detailing multiple vulnerabilities in Cisco Finesse’s web-based management interface.
These vulnerabilities, identified as CVE-2024-20404 and CVE-2024-20405, could allow unauthenticated, remote attackers to perform a stored cross-site scripting (XSS) attack.
The vulnerabilities in question involve a remote file inclusion (RFI) vulnerability and a server-side request forgery (SSRF) attack.
Specifically, the stored XSS attack can be executed by exploiting the RFI vulnerability, while the SSRF attack can be conducted on an affected system through Cisco Finesse’s web-based management interface.
Cisco has classified these vulnerabilities’ Security Impact Rating (SIR) as Medium, primarily due to the limited scope of information accessible to the attacker.
The Common Vulnerability Scoring System (CVSS) base score for these vulnerabilities is 7.2, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
This indicates that the vulnerabilities are network exploitable, require low attack complexity, and do not require privileges or user interaction but have a limited impact on confidentiality and integrity.
Affected Products & Mitigation
At the time of publication, the vulnerabilities affected the following Cisco Finesse releases:
- 11.6(1) ES11 and earlier
- 12.6(2) ES01 and earlier
Cisco has released software updates to address these vulnerabilities. Users are advised to migrate to the fixed releases to mitigate the risks associated with these vulnerabilities. The first fixed releases are:
- 11.6(1) ES11 and earlier: Migrate to a fixed release.
- 12.6(2) ES01 and earlier: Update to 12.6(2) ES03.
No workarounds are available for these vulnerabilities, making it crucial for users to apply the provided updates.
These vulnerabilities highlight the importance of keeping software up to date and applying security patches promptly. Cisco’s proactive release of updates aims to protect users from potential exploitation by malicious actors. Users can refer to the official Cisco Security Advisory here for more detailed information.
#Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news #vulnerability
Оригинальная версия на сайте:
