CVE-2021-1246: Cisco Finesse OpenSocial Gadget Editor Unauthenticated Access Vulnerability
First published: Wed Jan 13 2021(Updated: )
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Finesse | <12.0\(1\) | |
| Cisco Finesse | =12.0\(1\) | |
| Cisco Finesse | =12.0\(1\)-es1 | |
| Cisco Finesse | =12.0\(1\)-es2 | |
| Cisco Finesse | =12.0\(1\)-es3 | |
| Cisco Finesse | =12.0\(1\)-es4 | |
| Cisco Finesse | =12.0\(1\)-es5 | |
| Cisco Finesse | =12.5\(1\) | |
| Cisco Finesse | =12.5\(1\)-es1 | |
| Cisco Finesse | =12.5\(1\)-es2 | |
| Cisco Finesse | =12.5\(1\)-es3 | |
| Cisco Finesse | =12.5\(1\)-es4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-1246?
CVE-2021-1246 refers to multiple vulnerabilities in the web-based management interface of Cisco Finesse.
What is the severity of CVE-2021-1246?
CVE-2021-1246 has a severity rating of 6.1 (Medium).
How can an attacker exploit CVE-2021-1246?
An attacker can exploit CVE-2021-1246 by conducting a cross-site scripting (XSS) attack and obtaining potentially confidential information.
Which versions of Cisco Finesse are affected by CVE-2021-1246?
Versions 12.0(1) and 12.5(1) of Cisco Finesse are affected by CVE-2021-1246.
Where can I find more information about CVE-2021-1246?
You can find more information about CVE-2021-1246 in the Cisco Security Advisory available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/references
- agent/tags
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco finesse
- version/cisco finesse/12.0\(1\)
- version/cisco finesse/12.0\(1\)-es1
- version/cisco finesse/12.0\(1\)-es2
- version/cisco finesse/12.0\(1\)-es3
- version/cisco finesse/12.0\(1\)-es4
- version/cisco finesse/12.0\(1\)-es5
- version/cisco finesse/12.5\(1\)
- version/cisco finesse/12.5\(1\)-es1
- version/cisco finesse/12.5\(1\)-es2
- version/cisco finesse/12.5\(1\)-es3
- version/cisco finesse/12.5\(1\)-es4