Cisco Finesse/CVP Unauthenticated Access and XSS Vulnerabilities (CVE-2021-1245/1246) Analysis

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Products: Cisco Finesse, Cisco Virtualized Voice Browser, Cisco Unified Customer Voice Portal (CVP) - Vulnerability Type: Unauthorized access, Cross-Site Scripting (XSS) attacks - Affected Versions: Include Cisco Finesse 12.0(1) ES3 and 12.5(1), Cisco Virtualized Voice Browser 12.6(1), Cisco Unified CVP 12.6(2) ES4 to 12.6(2) ES17. 2. Vulnerability Details: - Attack Method: Unauthorized attackers can exploit these vulnerabilities by accessing a specially crafted URL. - Impact: Attackers can access specific sections of the management interface, retrieve sensitive information, or create arbitrary XML files. 3. Mitigation: - Software Updates Released: Cisco has released software updates to fix these vulnerabilities. - Workarounds: No workarounds are available. 4. Affected Products: - Vulnerable Products: Cisco Finesse, Cisco Virtualized Voice Browser, Cisco Unified CVP - Confirmed Not Vulnerable: Other products are not affected. 5. Rating: - CVSS Base Score: 6.5 - Security Impact Rating (SIR): Medium 6. Source: - CVE IDs: CVE-2021-1246 and CVE-2021-1245 - Reporters: Brett Staniforth, Christopher Benscoter, and David Sullivan 7. Update History: - Versions: 2.1 and 2.0 - Description: Updated the list of affected products and information on fixed versions. This information helps users understand the details of the vulnerability, the scope of affected products, and how to remediate the issue by applying software updates.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Finesse/CVP Unauthenticated Access and XSS Vulnerabilities (CVE-2021-1245/1246) Analysis