Medium severity · published Mar 3, 2023
CVE-2023-20061
Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system. Cisco plans to release software updates that address these vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Packaged Contact Center Enterprise · Cisco
All versions, or not specified · source: NVD
UC
Unified Contact Center Enterprise · Cisco
All versions, or not specified · source: NVD
UC
Unified Contact Center Express · Cisco
All versions, or not specified · source: NVD
UI
Unified Intelligence Center · Cisco
before 12.6\(2\) · source: NVD
Affected product
PC
Packaged Contact Center Enterprise
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-20061
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-20061
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-infodisc-ssrf-84ZBmwVk
More from Packaged Contact Center Enterprise
8.8
CVE-2018-0445
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a CSRF attack and…
6.1
CVE-2023-20058
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site…
6.1
CVE-2021-1395
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)…
6.1
CVE-2018-0444
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack…
4.3
CVE-2023-20062
Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request…