CVE-2016-1373
HighSummary
The gadgets-integration API in Cisco Finesse versions 8.5(1) through 11.0(1) is vulnerable to server-side request forgery (SSRF) attacks via a crafted request. An attacker can exploit this vulnerability to conduct unauthorized requests to the server.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive information or allow attackers to access internal network resources. Organizations should be aware of the risks associated with unauthorized access to systems.
Recommendation
It is recommended to update Cisco Finesse to the latest version to mitigate this vulnerability. Additionally, monitoring and restricting access to the gadgets-integration API is advisable.
Other vulnerabilities in Cisco Finesse
See all- CVE-2026-20362High
A vulnerability in the web-based management interface of Cisco Finesse is due to improper input validation for specific HTTP requests. An unauthenticated, remote attacker could send a crafted HTTP request to conduct server-side request forgery (SSRF) attacks. A successful exploit could allow the attacker to obtain limited sensitive information for services associated with the affected device.
- CVE-2026-20175Medium
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session, possibly leading to browser-based attacks. This is due to insufficient validation of user-supplied input for HTTP requests.
Original NVD description (English source)
The gadgets-integration API in Cisco Finesse 8.5(1) through 8.5(5), 8.6(1), 9.0(1), 9.0(2), 9.1(1), 9.1(1)SU1, 9.1(1)SU1.1, 9.1(1)ES1 through 9.1(1)ES5, 10.0(1), 10.0(1)SU1, 10.0(1)SU1.1, 10.5(1), 10.5(1)ES1 through 10.5(1)ES4, 10.5(1)SU1, 10.5(1)SU1.1, 10.5(1)SU1.7, 10.6(1), 10.6(1)SU1, 10.6(1)SU2, and 11.0(1) allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted request, aka Bug ID CSCuw86623.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS