Web Cache Poisoning Risk in Cisco Unified Contact Center Express

CVE-2023-20232

What is CVE-2023-20232?

A flaw in the Tomcat implementation for Cisco Unified Contact Center Express allows unauthenticated, remote actors to initiate a web cache poisoning attack. This vulnerability arises from inadequate validation of HTTP requests, enabling attackers to exploit it by sending specially crafted requests to specific API endpoints on the Unified CCX Finesse Portal. A successful exploitation can redirect users through the internal WebProxy to malicious sites controlled by the attacker, potentially compromising sensitive information and disrupting service.

References