CVE-2019-15259: Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability
First published: Wed Oct 02 2019(Updated: )
A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request on an affected device. A successful exploit could allow the attacker to perform cross-site scripting attacks, web cache poisoning, access sensitive browser-based information, and similar exploits.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Contact Center Express | <11.6\(2\) | |
| Cisco Unified Contact Center Express | =12.0\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-15259?
CVE-2019-15259 is a vulnerability in Cisco Unified Contact Center Express (UCCX) Software that allows an unauthenticated remote attacker to conduct an HTTP response splitting attack.
How does CVE-2019-15259 affect Cisco Unified Contact Center Express?
CVE-2019-15259 affects Cisco Unified Contact Center Express software versions 11.6(2) and 12.0(1).
What is the severity of CVE-2019-15259?
The severity of CVE-2019-15259 is medium with a CVSS score of 6.1.
How can an attacker exploit CVE-2019-15259?
An attacker can exploit CVE-2019-15259 by sending specially crafted requests to the affected system's web server.
Is there a fix for CVE-2019-15259?
Yes, Cisco has released a security advisory with patches and recommended mitigations for CVE-2019-15259.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/title
- agent/event
- agent/first-publish-date
- agent/tags
- agent/description
- vendor/cisco
- canonical/cisco unified contact center express
- version/cisco unified contact center express/12.0\(1\)