CVE-2023-20088: Cisco Finesse Reverse Proxy VPN-less Access to Finesse Desktop Denial of Service Vulnerability
First published: Fri Mar 03 2023(Updated: )
A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users who are connected through a load balancer. This vulnerability is due to improper IP address filtering by the reverse proxy. An attacker could exploit this vulnerability by sending a series of unauthenticated requests to the reverse proxy. A successful exploit could allow the attacker to cause all current traffic and subsequent requests to the reverse proxy through a load balancer to be dropped, resulting in a DoS condition.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Finesse | <12.6\(1\) | |
| Cisco Finesse | =12.6\(1\) | |
| Cisco Finesse | =12.6\(1\)-es01 | |
| Cisco Finesse | =12.6\(1\)-es02 | |
| Cisco Finesse | =12.6\(1\)-es03 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-20088.
What is the severity of CVE-2023-20088?
CVE-2023-20088 has a severity rating of 7.5 (high).
How does CVE-2023-20088 affect Cisco Finesse?
CVE-2023-20088 affects Cisco Finesse by allowing an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users who are connected through a load balancer.
Which versions of Cisco Finesse are affected by CVE-2023-20088?
CVE-2023-20088 affects Cisco Finesse version 12.6(1), 12.6(1)-es01, 12.6(1)-es02, and 12.6(1)-es03.
How can I fix CVE-2023-20088?
To fix CVE-2023-20088, it is recommended to apply the necessary patches or updates provided by Cisco.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco finesse
- version/cisco finesse/12.6\(1\)
- version/cisco finesse/12.6\(1\)-es01
- version/cisco finesse/12.6\(1\)-es02
- version/cisco finesse/12.6\(1\)-es03