Vulnerability · Published Jun 3, 2020 · Assigned by cisco

CVE-2020-3267Cisco Unified Contact Center Express Improper API Authorization Vulnerability

Medium 5.4

In plain English

A medium-severity security flaw in Cisco Unified Contact Center Express from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.0)5.4Medium

Exploit odds (30 days)0.8%top 43.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by authenticating to an affected system with valid agent credentials and performing a specific API call with crafted input. A successful exploit could allow the attacker to change the availability state of an agent, potentially causing a denial of service condition.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Unified Contact Center Express	n/a

Weakness: CWE-285 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

20200603 Cisco Unified Contact Center Express Improper API Authorization Vulnerability vendor-advisory, x_refsource_CISCO