CVE-2021-1246 (GCVE-0-2021-1246)

Vulnerability from cvelistv5 – Published: 2021-01-13 21:17 – Updated: 2024-09-17 03:38
VLAI?
Summary
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:X
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Vendor Product Version
Cisco Cisco Unified Customer Voice Portal (CVP) Affected: 12.6(2)_ES4
Affected: 12.6(2)_ET5
Affected: 12.6(2)_ET7
Affected: 12.6(2)_ET8
Affected: 12.6(2)_ES9
Affected: 12.6(2)_ES10
Affected: 12.6(2)_ES11
Affected: 12.6(2)_ET12
Affected: 12.6(2)_ET13
Affected: 12.6(2)_ES14
Affected: 12.6(2)_ES15
Affected: 12.6(2)_ET16
Affected: 12.6(2)_ET17
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:02:56.385Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20210113 Cisco Finesse OpenSocial Gadget Editor Vulnerabilities",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-1246",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T16:23:08.120669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-13T16:23:11.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Unified Customer Voice Portal (CVP)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "12.6(2)_ES4"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET5"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET7"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET8"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ES9"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ES10"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ES11"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET12"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET13"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ES14"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ES15"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET16"
            },
            {
              "status": "affected",
              "version": "12.6(2)_ET17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability\r\n\r\nA vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials.\r\nThe vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files.\r\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco\u00a0Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:X",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-11T15:19:05.950Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-multi-vuln-finesse-qp6gbUO2",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2"
        }
      ],
      "source": {
        "advisory": "cisco-sa-multi-vuln-finesse-qp6gbUO2",
        "defects": [
          "CSCvs52916"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Finesse OpenSocial Gadget Editor Unauthenticated Access Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-1246",
    "datePublished": "2021-01-13T21:17:33.721065Z",
    "dateReserved": "2020-11-13T00:00:00",
    "dateUpdated": "2024-09-17T03:38:45.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.0\\\\(1\\\\)\", \"matchCriteriaId\": \"DD40E978-4C22-42CF-BDAF-EEB2EB6B3416\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D876E49-DF49-4CEF-B2E8-95AEB5FE651A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es1:*:*:*:*:*:*\", \"matchCriteriaId\": \"02E2FDD7-5C71-426B-8578-2B57582BC76F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es2:*:*:*:*:*:*\", \"matchCriteriaId\": \"ECAE1945-C1AF-488D-90AA-BDF6BE2C9B8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es3:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BEF7143-A46F-4591-96CA-765503897C09\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1BB52449-3211-42CC-85D7-C0E6EC4A4BDA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es5:*:*:*:*:*:*\", \"matchCriteriaId\": \"5E28915E-1F4D-4A65-9FEB-848908567277\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):-:*:*:*:*:*:*\", \"matchCriteriaId\": \"3629695A-A121-4963-9BAC-9AEF3A4FABF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es1:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6DC24C6-F2A0-431F-86BA-68F706E19549\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es2:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F457A6B-426E-426D-9229-0609727E59AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es3:*:*:*:*:*:*\", \"matchCriteriaId\": \"96F4A329-A0DE-4853-B605-F26DD5C96BBB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es4:*:*:*:*:*:*\", \"matchCriteriaId\": \"B75F5E70-70EB-4C39-972D-5E55FACC6540\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability\\r\\n\\r\\nA vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials.\\r\\nThe vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files.\\r\\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\"}, {\"lang\": \"es\", \"value\": \"M\\u00faltiples vulnerabilidades en la interfaz de administraci\\u00f3n basada en web de Cisco Finesse, podr\\u00edan permitir a un atacante remoto no autenticado llevar a cabo un ataque de tipo cross-site scripting (XSS) y obtener informaci\\u00f3n potencialmente confidencial aprovechando un fallo en el mecanismo de autenticaci\\u00f3n.\u0026#xa0;Para m\\u00e1s informaci\\u00f3n sobre estas vulnerabilidades, consulte la secci\\u00f3n Detalles de este aviso.\"}]",
      "id": "CVE-2021-1246",
      "lastModified": "2024-11-21T05:43:55.060",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 2.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2021-01-13T22:15:21.193",
      "references": "[{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-306\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-1246\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2021-01-13T22:15:21.193\",\"lastModified\":\"2024-11-21T05:43:55.060\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability\\r\\n\\r\\nA vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials.\\r\\nThe vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files.\\r\\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web de Cisco Finesse, podr\u00edan permitir a un atacante remoto no autenticado llevar a cabo un ataque de tipo cross-site scripting (XSS) y obtener informaci\u00f3n potencialmente confidencial aprovechando un fallo en el mecanismo de autenticaci\u00f3n.\u0026#xa0;Para m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.0\\\\(1\\\\)\",\"matchCriteriaId\":\"DD40E978-4C22-42CF-BDAF-EEB2EB6B3416\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D876E49-DF49-4CEF-B2E8-95AEB5FE651A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es1:*:*:*:*:*:*\",\"matchCriteriaId\":\"02E2FDD7-5C71-426B-8578-2B57582BC76F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es2:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECAE1945-C1AF-488D-90AA-BDF6BE2C9B8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BEF7143-A46F-4591-96CA-765503897C09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BB52449-3211-42CC-85D7-C0E6EC4A4BDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.0\\\\(1\\\\):es5:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E28915E-1F4D-4A65-9FEB-848908567277\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3629695A-A121-4963-9BAC-9AEF3A4FABF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6DC24C6-F2A0-431F-86BA-68F706E19549\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F457A6B-426E-426D-9229-0609727E59AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es3:*:*:*:*:*:*\",\"matchCriteriaId\":\"96F4A329-A0DE-4853-B605-F26DD5C96BBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:finesse:12.5\\\\(1\\\\):es4:*:*:*:*:*:*\",\"matchCriteriaId\":\"B75F5E70-70EB-4C39-972D-5E55FACC6540\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\",\"source\":\"psirt@cisco.com\"},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\", \"name\": \"20210113 Cisco Finesse OpenSocial Gadget Editor Vulnerabilities\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T16:02:56.385Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-1246\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-13T16:23:08.120669Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-13T16:22:01.997Z\"}}], \"cna\": {\"title\": \"Cisco Finesse OpenSocial Gadget Editor Unauthenticated Access Vulnerability\", \"source\": {\"defects\": [\"CSCvs52916\"], \"advisory\": \"cisco-sa-multi-vuln-finesse-qp6gbUO2\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:X\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Unified Customer Voice Portal (CVP)\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.6(2)_ES4\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET5\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET7\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET8\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ES9\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ES10\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ES11\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET12\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET13\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ES14\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ES15\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET16\"}, {\"status\": \"affected\", \"version\": \"12.6(2)_ET17\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco\\u00a0Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2\", \"name\": \"cisco-sa-multi-vuln-finesse-qp6gbUO2\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability\\r\\n\\r\\nA vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials.\\r\\nThe vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files.\\r\\nCisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-306\", \"description\": \"Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2024-09-11T15:19:05.950Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-1246\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-17T03:38:45.561Z\", \"dateReserved\": \"2020-11-13T00:00:00\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2021-01-13T21:17:33.721065Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.