CVE-2023-20232 is a web cache poisoning vulnerability in the Tomcat implementation of Cisco Unified Contact Center Express (Unified CCX). It stems from improper input validation of HTTP requests, allowing an unauthenticated, remote attacker to redirect users to an attacker-controlled host. Rated Medium with a CVSS score of 5.3, this vulnerability requires no user interaction or privileges, but its impact is limited to low integrity. The attack complexity is low, as it involves sending crafted HTTP requests to a specific API endpoint. Currently, there is no evidence of active exploitation, nor is public exploit code available (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage are minimal, indicating low public awareness and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.5\(1\)_su2_es05CPE matchmatch criteria | cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.