CVE-2019-15259: medium-severity vulnerability in Cisco Unified Contact Center Express
Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 1.1%
A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request on an affected device. A successful exploit could allow the attacker to perform cross-site scripting attacks, web cache poisoning, access sensitive browser-based information, and similar exploits.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Cisco · Cisco Unified Contact Center ExpressRelated CVEs — Cisco Unified Contact Center Express
In the same product, most dangerous first.
CVE-2024-20404HIGHCVE-2024-20404EPSS 22.6%CVE-2020-3280CRITICALCisco Unified Contact Center Express Remote Code Execution VulnerabilityEPSS 7.1%CVE-2019-1888HIGHCisco Unified Contact Center Express Privilege Escalation VulnerabilityEPSS 3.4%CVE-2024-20253CRITICALCVE-2024-20253EPSS 2.4%CVE-2019-12633MEDIUMCisco Unified Contact Center Express Request Processing Server-Side Request Forgery VulnerabilityEPSS 1.5%CVE-2019-1670MEDIUMCisco Unified Intelligence Center Software Cross-Site Scripting VulnerabilityEPSS 1.2%