Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability

A vulnerability in the Cisco Unified Serviceability component of Cisco Unified Contact Center Express (Cisco Unified CCX) could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack.

The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing an authenticated Unified CCX user to click a malicious link. An exploit could allow the attacker to perform actions in the Cisco Unified Serviceability pages with the privileges of the authenticated Unified CCX user.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.