Lucene search

CiscoCVE-2019-15259

HistoryOct 02, 2019 - 7:15 p.m.

CVE-2019-15259

2019-10-0219:15:15

CWE-113

CWE-74

cisco

web.nvd.nist.gov

cisco

uccx

vulnerability

http response splitting

cve-2019-15259

security advisory

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

47.0%

JSON

A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request on an affected device. A successful exploit could allow the attacker to perform cross-site scripting attacks, web cache poisoning, access sensitive browser-based information, and similar exploits.

Affected configurations

Nvd

Node

ciscounified_contact_center_expressRange<11.6\(2\)

ciscounified_contact_center_expressMatch12.0\(1\)

VendorProductVersionCPE
ciscounified_contact_center_express*cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*
ciscounified_contact_center_express12.0(1)cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_contact_center_express	*	cpe:2.3:a:cisco:unified_contact_center_express::::::::
cisco	unified_contact_center_express	12.0(1)	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):::::::*

CNA Affected

[
  {
    "product": "Cisco Unified Contact Center Express",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-uccx-http

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

47.0%

JSON

Related for CVE-2019-15259