CVE-2025-20114

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Authorization Bypass Through User-Controlled Key pada cisco unified intelligence center, cisco unified contact center express. Skor CVSS 3.1 4.3 (Medium) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

Rincian

Terbit di NVD

21 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 73 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4 advisory vendor