CVE-2019-15259: Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability
A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request on an affected device. A successful exploit could allow the attacker to perform cross-site scripting attacks, web cache poisoning, access sensitive browser-based information, and similar exploits.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15259?
CVE-2019-15259 is a vulnerability in Cisco Unified Contact Center Express (UCCX) Software that allows an unauthenticated remote attacker to conduct an HTTP response splitting attack.
How does CVE-2019-15259 affect Cisco Unified Contact Center Express?
CVE-2019-15259 affects Cisco Unified Contact Center Express software versions 11.6(2) and 12.0(1).
What is the severity of CVE-2019-15259?
The severity of CVE-2019-15259 is medium with a CVSS score of 6.1.
How can an attacker exploit CVE-2019-15259?
An attacker can exploit CVE-2019-15259 by sending specially crafted requests to the affected system's web server.
Is there a fix for CVE-2019-15259?
Yes, Cisco has released a security advisory with patches and recommended mitigations for CVE-2019-15259.