CVE-2020-3267
Cisco Unified Contact Center Express Improper API Authorization Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by authenticating to an affected system with valid agent credentials and performing a specific API call with crafted input. A successful exploit could allow the attacker to change the availability state of an agent, potentially causing a denial of service condition.
Una vulnerabilidad en el subsistema de la API de Cisco Unified Contact Center Express (Unified CCX), podría permitir a un atacante remoto autenticado cambiar el estado de disponibilidad de cualquier agente. La vulnerabilidad es debido a una insuficiente aplicación de la autorización sobre un sistema afectado. Un atacante podría explotar esta vulnerabilidad autenticándose sobre un sistema afectado con credenciales de agente válidas y llevando a cabo una llamada API específica con una entrada diseñada. Una explotación con éxito podría permitir al atacante cambiar el estado de disponibilidad de un agente, causando potencialmente una condición de denegación de servicio.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2019-12-12 CVE Reserved
- 2020-06-03 CVE Published
- 2023-03-07 EPSS Updated
- 2024-11-15 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-285: Improper Authorization
- CWE-552: Files or Directories Accessible to External Parties
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Unified Contact Center Express Search vendor "Cisco" for product "Unified Contact Center Express" | < 12.5\(1\) Search vendor "Cisco" for product "Unified Contact Center Express" and version " < 12.5\(1\)" | - |
Affected
|