Cisco Security Advisory - Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability

[Netwörkheäd]

Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability

<p>A vulnerability in the web-based management interface of Cisco&nbsp;Unified Contact Center Management Portal (Unified CCMP) and Cisco&nbsp;Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to <em>Administrator</em>.</p>
<p>This vulnerability is due to the lack of server-side validation of user permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to a vulnerable system. A successful exploit could allow the attacker to create <em>Administrator</em> accounts. With these accounts, the attacker could access and modify telephony and user resources across all the Unified platforms that are associated to the vulnerable&nbsp;Cisco&nbsp;Unified CCMP. To successfully exploit this vulnerability, an attacker would need valid <em>Advanced User</em> credentials.</p>
<p>Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.</p>
<p>This advisory is available at the following link:<br><a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmp-priv-esc-JzhTFLm4">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmp-priv-esc-JzhTFLm4</a></p>

     
         
Security Impact Rating:  Critical
   
   
       
CVE: CVE-2022-20658
Source: Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability