CVE-2021-1254
Description
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities by injecting malicious code into the web-based management interface and persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. An attacker needs valid administrator credentials to inject the malicious script code.
Risk Information
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Cisco Finesse Cross-Site Scripting Vulnerabilities For Cisco Finesse | NCM |
| Cisco Finesse Cross-Site Scripting Vulnerabilities For Cisco Packaged Contact Center Enterprise | NCM |
| Cisco Finesse Cross-Site Scripting Vulnerabilities For Cisco Unified Contact Center Express | NCM |
| CVE-2021-1254 | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-1705887 | Security Update for Cisco Finesse 11.5(0.98000.126) |
| PATCH-1705202 | Security Update for Cisco Packaged Contact Center Enterprise 12.6(1) |
| PATCH-1706052 | Security Update for Cisco Unified Contact Center Express 11.6(1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234