Lucene search

CiscoCVE-2017-6626

HistoryMay 03, 2017 - 9:59 p.m.

CVE-2017-6626

2017-05-0321:59:00

CWE-200

cisco

web.nvd.nist.gov

cisco

finesse

notification service

ucce

vulnerability

cve-2017-6626

agent information

unauthorized access

nvd

cisco bug ids

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allow an unauthenticated, remote attacker to retrieve information from agents using the Finesse Desktop. The vulnerability is due to the existence of a user account that has an undocumented, hard-coded password. An attacker could exploit this vulnerability by using the hard-coded credentials to subscribe to the Finesse Notification Service, which would allow the attacker to receive notifications when an agent signs in or out of the Finesse Desktop, when information about an agent changes, or when an agent’s state changes. Cisco Bug IDs: CSCvc08314.

Affected configurations

Nvd

Node

ciscounified_contact_center_enterpriseMatch11.5\(1\)

ciscounified_contact_center_enterpriseMatch11.6\(1\)

VendorProductVersionCPE
ciscounified_contact_center_enterprise11.5(1)cpe:2.3:a:cisco:unified_contact_center_enterprise:11.5\(1\):*:*:*:*:*:*:*
ciscounified_contact_center_enterprise11.6(1)cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\(1\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_contact_center_enterprise	11.5(1)	cpe:2.3:a:cisco:unified_contact_center_enterprise:11.5\(1\):::::::*
cisco	unified_contact_center_enterprise	11.6(1)	cpe:2.3:a:cisco:unified_contact_center_enterprise:11.6\(1\):::::::*

CNA Affected

[
  {
    "product": "Cisco Finesse for Cisco Unified Contact Center Enterprise",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Finesse for Cisco Unified Contact Center Enterprise"
      }
    ]
  }
]

References

www.securityfocus.com/bid/98291

www.securitytracker.com/id/1038396

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-finesse-ucce

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

Related for CVE-2017-6626