Cisco Finesse vulnerabilities

The gadgets-integration API in Cisco Finesse versions 8.5(1) through 11.0(1) is vulnerable to server-side request forgery (SSRF) attacks via a crafted request. An attacker can exploit this vulnerability to conduct unauthorized requests to the server.

A vulnerability in the web-based management interface of Cisco Finesse is due to improper input validation for specific HTTP requests. An unauthenticated, remote attacker could send a crafted HTTP request to conduct server-side request forgery (SSRF) attacks. A successful exploit could allow the attacker to obtain limited sensitive information for services associated with the affected device.

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session, possibly leading to browser-based attacks. This is due to insufficient validation of user-supplied input for HTTP requests.