Details of VAR-201605-0553

ID

VAR-201605-0553

CVE

CVE-2016-1373

TITLE

Cisco Finesse Gadget integration API Server-side request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-002713

DESCRIPTION

The gadgets-integration API in Cisco Finesse 8.5(1) through 8.5(5), 8.6(1), 9.0(1), 9.0(2), 9.1(1), 9.1(1)SU1, 9.1(1)SU1.1, 9.1(1)ES1 through 9.1(1)ES5, 10.0(1), 10.0(1)SU1, 10.0(1)SU1.1, 10.5(1), 10.5(1)ES1 through 10.5(1)ES4, 10.5(1)SU1, 10.5(1)SU1.1, 10.5(1)SU1.7, 10.6(1), 10.6(1)SU1, 10.6(1)SU2, and 11.0(1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCuw86623. Vendors have confirmed this vulnerability Bug ID CSCuw86623 It is released as. Supplementary information : CWE Vulnerability type by CWE-918: Server-Side Request Forgery (SSRF) ( Server-side request forgery ) Has been identified. Cisco Finesse is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. The software improves call center service quality, improves customer experience, and increases agent satisfaction. The vulnerability stems from the program not adequately restricting access to the gadgets-integration API. The following releases are affected: Cisco Finesse Release 8.5(1) through Release 8.5(5), Release 8.6(1), Release 9.0(1), Release 9.0(2), Release 9.1(1) through Release 9.1(1)SU1.1 Versions, 9.1(1)ES1 to 9.1(1)ES5, 10.0(1) to 10.0(1)SU1.1, 10.5(1), 10.5(1)ES1 to 10.5(1)ES4 , 10.5(1)SU1 release, 10.5(1)SU1.1 release, 10.5(1)SU1.7 release, 10.6(1) release, 10.6(1)SU1 release, 10.6(1)SU2 release, 11.0(1) Version

Trust: 1.98

sources: NVD: CVE-2016-1373 // JVNDB: JVNDB-2016-002713 // BID: 90006 // VULHUB: VHN-90192

AFFECTED PRODUCTS

vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_su1.1	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_es4	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_es5	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_su1	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0\(1\)_su1.1	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_base	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_es1	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0\(1\)_su1	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_es2	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_es3	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_su1.1	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.6\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	9.0\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_es4	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5\(4\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_su1.7	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_es3	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5\(2\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_es2	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	11.0\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	9.0\(2\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5\(3\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5\(5\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6\(1\)_su2	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5\(1\)_base	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_es1	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5\(1\)_su1	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6\(1\)_su1	Trust: 1.0
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0(1)su1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.0(1)su1.1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5(1)es1 to 10.5(1)es4	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5(1)su1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5(1)su1.1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.5(1)su1.7	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6(1)su1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6(1)su2	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	11.0(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	8.5(1) to 8.5(5)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	8.6(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.0(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.0(2)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1(1)	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1(1)es1 to 9.1(1)es5	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1(1)su1	Trust: 0.8
vendor:	cisco	model:	finesse	scope:	eq	version:	9.1(1)su1.1	Trust: 0.8

sources: JVNDB: JVNDB-2016-002713 // CNNVD: CNNVD-201605-111 // NVD: CVE-2016-1373

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-1373
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-1373
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201605-111
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-90192
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-1373
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-90192
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1373
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-90192 // JVNDB: JVNDB-2016-002713 // CNNVD: CNNVD-201605-111 // NVD: CVE-2016-1373

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2016-002713 // NVD: CVE-2016-1373

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-111

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201605-111

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-002713

PATCH

title:	cisco-sa-20160504-finesse	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-finesse	Trust: 0.8
title:	Cisco Finesse Remedial measures for server-side request forgery vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61434	Trust: 0.6

sources: JVNDB: JVNDB-2016-002713 // CNNVD: CNNVD-201605-111

EXTERNAL IDS

db:	NVD	id:	CVE-2016-1373	Trust: 2.8
db:	SECTRACK	id:	1035756	Trust: 1.1
db:	JVNDB	id:	JVNDB-2016-002713	Trust: 0.8
db:	CNNVD	id:	CNNVD-201605-111	Trust: 0.7
db:	BID	id:	90006	Trust: 0.3
db:	VULHUB	id:	VHN-90192	Trust: 0.1

sources: VULHUB: VHN-90192 // BID: 90006 // JVNDB: JVNDB-2016-002713 // CNNVD: CNNVD-201605-111 // NVD: CVE-2016-1373

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160504-finesse	Trust: 2.0
url:	http://www.securitytracker.com/id/1035756	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1373	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1373	Trust: 0.8
url:	http://www.cisco.com	Trust: 0.3

sources: VULHUB: VHN-90192 // BID: 90006 // JVNDB: JVNDB-2016-002713 // CNNVD: CNNVD-201605-111 // NVD: CVE-2016-1373

CREDITS

Juliano Rizzo

Trust: 0.9

sources: BID: 90006 // CNNVD: CNNVD-201605-111

SOURCES

db:	VULHUB	id:	VHN-90192
db:	BID	id:	90006
db:	JVNDB	id:	JVNDB-2016-002713
db:	CNNVD	id:	CNNVD-201605-111
db:	NVD	id:	CVE-2016-1373

LAST UPDATE DATE

2024-11-23T22:42:20.879000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-90192	date:	2016-12-01T00:00:00
db:	BID	id:	90006	date:	2016-07-06T14:36:00
db:	JVNDB	id:	JVNDB-2016-002713	date:	2016-05-18T00:00:00
db:	CNNVD	id:	CNNVD-201605-111	date:	2016-05-06T00:00:00
db:	NVD	id:	CVE-2016-1373	date:	2024-11-21T02:46:17.783

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-90192	date:	2016-05-05T00:00:00
db:	BID	id:	90006	date:	2016-05-04T00:00:00
db:	JVNDB	id:	JVNDB-2016-002713	date:	2016-05-18T00:00:00
db:	CNNVD	id:	CNNVD-201605-111	date:	2016-05-05T00:00:00
db:	NVD	id:	CVE-2016-1373	date:	2016-05-05T21:59:03.267