{"timestamp":"2024-09-13T16:23:35.929574Z","id":"CVE-2021-1245","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Cisco","product":"Cisco Unified Customer Voice Portal (CVP)","defaultStatus":"unknown","versions":[{"version":"12.6(2)_ES4","status":"affected"},{"version":"12.6(2)_ET5","status":"affected"},{"version":"12.6(2)_ET7","status":"affected"},{"version":"12.6(2)_ET8","status":"affected"},{"version":"12.6(2)_ES9","status":"affected"},{"version":"12.6(2)_ES10","status":"affected"},{"version":"12.6(2)_ES11","status":"affected"},{"version":"12.6(2)_ET12","status":"affected"},{"version":"12.6(2)_ET13","status":"affected"},{"version":"12.6(2)_ES14","status":"affected"},{"version":"12.6(2)_ES15","status":"affected"},{"version":"12.6(2)_ET16","status":"affected"},{"version":"12.6(2)_ET17","status":"affected"}]}]

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory.

Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Cisco Systems, Inc. CWE-79

Cisco Systems, Inc. CWE-306

Cisco Systems, Inc. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2 [No types assigned]

Cisco Systems, Inc. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2

Cisco Systems, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Cisco Systems, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NIST AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NIST (AV:N/AC:M/Au:N/C:N/I:P/A:N)

NIST CWE-79

OR
     *cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:* versions up to (excluding) 12.0\(1\)
     *cpe:2.3:a:cisco:finesse:12.0\(1\):-:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.0\(1\):es1:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.0\(1\):es2:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.0\(1\):es3:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.0\(1\):es4:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.0\(1\):es5:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.5\(1\):-:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.5\(1\):es1:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.5\(1\):es2:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.5\(1\):es3:*:*:*:*:*:*
     *cpe:2.3:a:cisco:finesse:12.5\(1\):es4:*:*:*:*:*:*

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2 No Types Assigned

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2 Vendor Advisory

Victim must voluntarily interact with attack mechanism