Cisco Finesse/CVP OpenSocial Gadget Editor Unauth Access & XSS (CVE-2021-1246/1245)

Vulnerability Key Information Vulnerability Overview Vulnerability Name: Multiple Cisco Products OpenSocial Gadget Editor Vulnerabilities Severity: Medium Disclosure Date: 2021-01-13 Update Date: 2024-09-03 Affected Products: - Cisco Finesse (versions prior to 12.0(1) ES3 and 12.5(1)) - Cisco Virtualized Voice Browser (versions prior to 12.6(1)) - Cisco Unified CVP (versions 12.6(2) ES4 to 12.6(2) ES17) Vulnerability Details CVE IDs: - CVE-2021-1246: Unauthenticated Remote Access Vulnerability - CVE-2021-1245: Cross-Site Scripting (XSS) Vulnerability CVSS Scores: - CVE-2021-1246: Base Score 6.5 - CVE-2021-1245: Base Score 6.1 Impact and Exploitation Unauthenticated remote attackers can access the OpenSocial Gadget Editor via crafted URLs, enabling them to retrieve confidential information and create arbitrary XML files. The XSS vulnerability allows attackers to execute arbitrary script code by tricking users into clicking malicious links, thereby accessing sensitive browser information. Remediation and Mitigation Workarounds: No workarounds available Fixed Versions: - Cisco Finesse: 12.0(1) ES3, 12.5(1) and later - Cisco Virtualized Voice Browser: 12.6(1) and later - Cisco Unified CVP: 12.6(2) ES18 and later Announcements: No public advisories or malicious exploitation of these vulnerabilities have been observed Vulnerability History and Source CVE-2021-1246 was discovered within Cisco TAC support cases. CVE-2021-1245 was independently reported by a security researcher.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Finesse/CVP OpenSocial Gadget Editor Unauth Access & XSS (CVE-2021-1246/1245)