CyberCVE

CVE-2024-20325

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service

Severity
Medium 5.1
CVSS 3.1
Exploited
Not listed
EPSS
0.001
4.0th percentile
Discovered by
Third party
Published by the vendor
Published
Feb 21, 2024
Assigned by cisco

Description

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.

Weakness: CWE-284

Affected products

Vendor Product Category Matched by
Cisco Cisco Contact Center Other Products cna-assigner
Vendor-reported affected versions (2)
  • Cisco · Cisco Unified Intelligence Center
  • cisco · unified_intelligence_center

References