CVE-2023-20232

State: Published
Severity: 5.3 Medium
Published: Aug 16, 2023
Updated: Aug 2, 2024
Reserved: Oct 27, 2022

Description

A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific API endpoint on the Unified CCX Finesse Portal. A successful exploit could allow the attacker to cause the internal WebProxy to redirect users to an attacker-controlled host.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Cisco Unified Contact Center ExpressCisco	8.5(1)Affected 9.0(2)SU3ES04Affected 10.0(1)SU1Affected 10.0(1)SU1ES04Affected 10.5(1)Affected 10.5(1)SU1Affected 10.5(1)SU1ES10Affected 10.6(1)Affected 10.6(1)SU1Affected 10.6(1)SU3Affected 10.6(1)SU2Affected 10.6(1)SU3ES03Affected 10.6(1)SU2ES04Affected 10.6(1)SU3ES02Affected 10.6(1)SU3ES01Affected 11.0(1)SU1Affected 11.0(1)SU1ES03Affected 11.0(1)SU1ES02Affected 11.5(1)SU1Affected 11.5(1)SU1ES02Affected 11.5(1)SU1ES01Affected 11.5(1)SU1ES03Affected 11.5(1)ES01Affected 12.0(1)Affected 12.0(1)ES01Affected and 30 more versions

Product

Versions

Cisco Unified Contact Center ExpressCisco

8.5(1)Affected
9.0(2)SU3ES04Affected
10.0(1)SU1Affected
10.0(1)SU1ES04Affected
10.5(1)Affected
10.5(1)SU1Affected
10.5(1)SU1ES10Affected
10.6(1)Affected
10.6(1)SU1Affected
10.6(1)SU3Affected
10.6(1)SU2Affected
10.6(1)SU3ES03Affected
10.6(1)SU2ES04Affected
10.6(1)SU3ES02Affected
10.6(1)SU3ES01Affected
11.0(1)SU1Affected
11.0(1)SU1ES03Affected
11.0(1)SU1ES02Affected
11.5(1)SU1Affected
11.5(1)SU1ES02Affected
11.5(1)SU1ES01Affected
11.5(1)SU1ES03Affected
11.5(1)ES01Affected
12.0(1)Affected
12.0(1)ES01Affected
and 30 more versions

References

cisco-sa-uccx-wcp-JJeqDT3S

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.