Cisco Unified CCX Security Advisory: RCE, XSS, Path Traversal (CVE-2023-20276-20279)

Critical Vulnerability Information Vulnerability Overview CVE IDs: CVE-2023-20276, CVE-2023-20277, CVE-2023-20278, CVE-2023-20279 Severity: Medium Release Date: June 14, 2023 Patch Date: June 14, 2023 Affected Products Cisco Unified Contact Center Express (Cisco Unified CCX) Vulnerability Details 1. CVE-2023-20279: Cisco Unified CCX Stored XSS Vulnerability - Description: A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Unified CCX, allowing an authenticated remote attacker to execute cross-site scripting attacks on the affected system. - CVSS Score: 5.4 - Impact: The attacker must possess valid administrative credentials to exploit this vulnerability. 2. CVE-2023-20276: Cisco Unified CCX Remote Code Execution Vulnerability - Description: A remote code execution vulnerability exists in the web-based management interface of Cisco Unified CCX, enabling an authenticated remote attacker to execute arbitrary commands on the affected device. - CVSS Score: 7.2 - Impact: The attacker must possess valid administrative credentials to exploit this vulnerability. 3. CVE-2023-20277: Cisco Unified CCX Path Traversal Vulnerability - Description: A path traversal vulnerability exists in the web-based management interface of Cisco Unified CCX, allowing an authenticated local attacker to execute arbitrary code on the affected device. - CVSS Score: 6.1 - Impact: The attacker must possess valid administrative credentials to exploit this vulnerability. Remediation Fixed Versions: Cisco has released software updates to address these vulnerabilities. Recommendation: Customers should regularly check the Cisco Product Security Incident Response Team (PSIRT) advisory page to determine if software upgrades or patches are available. Additional Information Source: Cisco thanks Antonin B. from NATO Cyber Security Centre (NCSC) for reporting these vulnerabilities. URL: Cisco Security Advisory

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Unified CCX Security Advisory: RCE, XSS, Path Traversal (CVE-2023-20276-20279)