What is CVE-2021-1246?

CVE-2021-1246 is a medium-severity vulnerability in Cisco Unified Customer Voice Portal (Cvp), classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2021-01-13.

How severe is CVE-2021-1246?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XSS in Cisco Unified Customer Voice Portal (Cvp)

CVE-2021-1246

Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Vulnerability class: Broken Authentication

EPSS: 0.014 (71.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Cisco Unified Customer Voice Portal (Cvp) — versions 12.6(2)_ES4, 12.6(2)_ET5, 12.6(2)_ET7
Cisco Finesse — versions 12.5(1), 12.5\(1\), 12.0(1)

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2021-1246?: CVE-2021-1246 is a medium-severity vulnerability in Cisco Unified Customer Voice Portal (Cvp), classified under Missing Authentication for Critical Function. CVSS score: 6.5/10. Published 2021-01-13.
How severe is CVE-2021-1246?: Medium severity. CVSS v3 base score is 6.5 out of 10.