Riskcovery

CVE-2025-20129

Cisco Customer Collaboration Platform Information Disclosure Vulnerability

State
Published
Severity
4.3 Medium
Published
Jun 4, 2025
Updated
Jun 4, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data.

This vulnerability is due to improper sanitization of HTTP requests that are sent to the web-based chat interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the chat interface of a targeted user on a vulnerable server. A successful exploit could allow the attacker to redirect chat traffic to a server that is under their control, resulting in sensitive information being redirected to the attacker.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Ncisco

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
Cisco SocialMinerCisco
  • 12.5(1)ES01Affected
  • 10.5(1)Affected
  • 11.6(1)Affected
  • 10.6(1)Affected
  • 12.0(1)ES04Affected
  • 10.6(2)Affected
  • 12.5(1)Affected
  • 11.6(2)Affected
  • 12.0(1)Affected
  • 12.0(1)ES02Affected
  • 11.0(1)Affected
  • 11.5(1)Affected
  • 11.5(1)SU1Affected
  • 12.0(1)ES03Affected
  • 12.5(1)SU3Affected
  • 12.5(1)SU1Affected
  • 12.5(1)SU2Affected
Cisco Unified Contact Center ExpressCisco
  • 10.6(1)Affected
  • 10.5(1)SU1Affected
  • 10.6(1)SU3Affected
  • 12.0(1)Affected
  • 10.0(1)SU1Affected
  • 10.6(1)SU1Affected
  • 11.0(1)SU1Affected
  • 11.5(1)SU1Affected
  • 10.5(1)Affected
  • 11.6(1)Affected
  • 11.6(2)Affected
  • 12.5(1)Affected
  • 12.5(1)SU1Affected
  • 12.5(1)SU2Affected
  • 12.5(1)SU3Affected
  • 12.5(1)_SU03_ES01Affected
  • 12.5(1)_SU03_ES02Affected
  • 12.5(1)_SU02_ES03Affected
  • 12.5(1)_SU02_ES04Affected
  • 12.5(1)_SU02_ES02Affected
  • 12.5(1)_SU01_ES02Affected
  • 12.5(1)_SU01_ES03Affected
  • 12.5(1)_SU02_ES01Affected
  • 11.6(2)ES07Affected
  • 11.6(2)ES08Affected
  • and 35 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.