Arbitrary file upload in Cisco Unified Contact Center Express
CVE-2019-1888
A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to upload arbitrary files and execute commands on the underlying operating system. To exploit this vulnerability, an attacker needs valid Administrator credentials. The vulnerability is due to insufficient restrictions for the content uploaded to an affected system. An attacker could exploit this vulnerability by uploading arbitrary files containing operating system commands that will be executed by an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web interface and then elevate their privileges to root.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.034 (88.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.034 · newest: 0.034 · change: 0.000
Affected products
- Cisco Unified Contact Center Express
- Cisco Unified Contact Center Express — versions 11.6(2), 11.6\(1\), 12.0(1)
- Cisco Unified Ip Interactive Voice Response — versions 11.6(2), 11.6\(1\), 11.6(1)
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-pri… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1888?
- CVE-2019-1888 is a high-severity vulnerability in Cisco Unified Contact Center Express, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2020-09-23.
- How severe is CVE-2019-1888?
- High severity. CVSS v3 base score is 7.2 out of 10.