CVE-2020-3402
mediumPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.016 · 75. PerzentilEURUUSEPSS · bewertet 2026-10-28
A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not properly authenticated. An attacker could exploit this vulnerability by sending a crafted request to the affected listener. A successful exploit could allow the attacker to access sensitive information on an affected device.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCisco Unified IP Interactive Voice Response (IVR)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco Unified IP Interactive Voice Response (IVR)cisco_csaf
There is a workaround that addresses this vulnerability. It is possible to configure certificate-based authentication for the vulnerable interface. This is documented in the Secure JMX Communication between OAMP and Call Server using Mutual Authentication section of the Configuration Guide for Cisco Unified Customer Voice Portal, Release 12.5(1) ["https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/customer_voice_portal/cvp_12_5/configuration/guide/ccvp_b_configuration-guide-12-5-1/ccvp_b_configuration-guide-12-5-1_chapter_010001.html?bookSearch=true"].
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
- cisco unified customer voice portal≤ 12.5\(1\)nvdUScpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- cisco-sa-cvp-info-dislosure-NZBEwj9VCisco Unified Customer Voice Portal Information Disclosure Vulnerability2020-07-01csaf · cisco_csafUS
A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not properly authenticated. An attacker could exploit this vulnerability by sending a crafted request to the affected listener. A successful exploit could allow the attacker to access sensitive information on an affected device. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9V ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9V"]
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.nsfocus.net/vulndb/47069cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-3402cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9Vcnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2274.2/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2274/cnnvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9Venisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9VVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan