CVE-2021-1246: Cisco Finesse OpenSocial Gadget Editor Unauthenticated Access Vulnerability
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Other sources
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-1246?
CVE-2021-1246 refers to multiple vulnerabilities in the web-based management interface of Cisco Finesse.
What is the severity of CVE-2021-1246?
CVE-2021-1246 has a severity rating of 6.1 (Medium).
How can an attacker exploit CVE-2021-1246?
An attacker can exploit CVE-2021-1246 by conducting a cross-site scripting (XSS) attack and obtaining potentially confidential information.
Which versions of Cisco Finesse are affected by CVE-2021-1246?
Versions 12.0(1) and 12.5(1) of Cisco Finesse are affected by CVE-2021-1246.
Where can I find more information about CVE-2021-1246?
You can find more information about CVE-2021-1246 in the Cisco Security Advisory available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2