Cross-site request forgery in Cisco Finesse - CVE-2016-6442
Published: October 12, 2016 / Updated: April 5, 2018
Vulnerability identifier: #VU941
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-6442
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco Finesse
Cisco Finesse
Detailed vulnerability description
The vulnerability allows a remote unauthenticated user to perform cross-site request forgery attack on the target system.
The weakness is due to insufficient CSRF protections. By persuading the victim to follow a malicious link or visit an attacker-controlled website, a remote user can send arbitrry requests to the target device via the web browser with the privileges of the valid user.
Successful exploitation of the vulnerability will result in performing of CSRF attack on the vulnerable system.
The weakness is due to insufficient CSRF protections. By persuading the victim to follow a malicious link or visit an attacker-controlled website, a remote user can send arbitrry requests to the target device via the web browser with the privileges of the valid user.
Successful exploitation of the vulnerability will result in performing of CSRF attack on the vulnerable system.
How to mitigate CVE-2016-6442
Install update from vendor's website.