Cross-site request forgery in Cisco Finesse

1) Cross-site request forgery

EUVDB-ID: #VU941

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-6442

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to perform cross-site request forgery attack on the target system.
The weakness is due to insufficient CSRF protections. By persuading the victim to follow a malicious link or visit an attacker-controlled website, a remote user can send arbitrry requests to the target device via the web browser with the privileges of the valid user.
Successful exploitation of the vulnerability will result in performing of CSRF attack on the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Cisco Finesse: 11.0.1

CPE2.3

• cpe:2.3:a:cisco_systems:cisco_finesse:11.0.1:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-fin

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.