Cisco Unified Contact Center Express CVE-2014-0745 Cross Site Request Forgery Vulnerability

Bugtraq ID:	65798
Class:	Input Validation Error
CVE:	CVE-2014-0745
Remote:	Yes
Local:	No
Published:	Feb 25 2014 12:00AM
Updated:	Mar 04 2014 02:11AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified Contact Center Express CVE-2014-0745 Cross Site Request Forgery Vulnerability

Cisco Unified Contact Center Express is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected user. Other attacks are also possible.

This issue is being tracked by Cisco bug ID CSCum95502.

Cisco Unified Contact Center Express CVE-2014-0745 Cross Site Request Forgery Vulnerability

To exploit the issue an attacker must entice a user into visiting a malicious site.

Cisco Unified Contact Center Express CVE-2014-0745 Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified Contact Center Express CVE-2014-0745 Cross Site Request Forgery Vulnerability

References:

• Cisco Homepage (Cisco )