Read the docs
TI-2023-06937 Aliases CVE-2023-20232GHSA-38hg-9xjj-pc2r

Improper input validation in Cisco Unified Contact Center Express

Priority LOW 25CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific API endpoint on the Unified CCX Finesse Portal. A successful exploit could allow the attacker to cause the internal WebProxy to redirect users to an attacker-controlled host.

Why it matters now

EPSS 0.0055 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Unified Contact Center Express8.5(1); 9.0(2)SU3ES04; 10.0(1)SU1; 10.0(1)SU1ES04; 10.5(1); 10.5(1)SU1; 10.5(1)SU1ES10; 10.6(1); 10.6(1)SU1; 10.6(1)SU3; 10.6(1)SU2; 10.6(1)SU3ES03; 10.6(1)SU2ES04; 10.6(1)SU3ES02; 10.6(1)SU3ES01; 11.0(1)SU1; 11.0(1)SU1ES03; 11.0(1)SU1ES02; 11.5(1)SU1; 11.5(1)SU1ES02; 11.5(1)SU1ES01; 11.5(1)SU1ES03; 11.5(1)ES01; 12.0(1); 12.0(1)ES01; 12.0(1)ES03; 12.0(1)ES04; 12.0(1)ES02; 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)_SU01_ES03; 12.5(1)ES03; 12.5(1)_SU01_ES01; 12.5(1)_SU02_ES02; 12.5(1)_SU01_ES02; 12.5(1)_SU02_ES03; 12.5(1)ES01; 12.5(1)_SU02_ES01; 12.5(1)ES02; 12.5(1)_SU03_ES01; 12.5(1)_SU02_ES04; 11.6(1); 11.6(2); 11.6(1)ES01; 11.6(2)ES06; 11.6(1)ES02; 11.6(2)ES01; 11.6(2)ES03; 11.6(2)ES07; 11.6(2)ES08; 11.6(2)ES02; 11.6(2)ES05; 11.6(2)ES04—No fix listedCNA
  • Cisco Unified Contact Center Express VendorCisco Affected 8.5(1); 9.0(2)SU3ES04; 10.0(1)SU1; 10.0(1)SU1ES04; 10.5(1); 10.5(1)SU1; 10.5(1)SU1ES10; 10.6(1); 10.6(1)SU1; 10.6(1)SU3; 10.6(1)SU2; 10.6(1)SU3ES03; 10.6(1)SU2ES04; 10.6(1)SU3ES02; 10.6(1)SU3ES01; 11.0(1)SU1; 11.0(1)SU1ES03; 11.0(1)SU1ES02; 11.5(1)SU1; 11.5(1)SU1ES02; 11.5(1)SU1ES01; 11.5(1)SU1ES03; 11.5(1)ES01; 12.0(1); 12.0(1)ES01; 12.0(1)ES03; 12.0(1)ES04; 12.0(1)ES02; 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)_SU01_ES03; 12.5(1)ES03; 12.5(1)_SU01_ES01; 12.5(1)_SU02_ES02; 12.5(1)_SU01_ES02; 12.5(1)_SU02_ES03; 12.5(1)ES01; 12.5(1)_SU02_ES01; 12.5(1)ES02; 12.5(1)_SU03_ES01; 12.5(1)_SU02_ES04; 11.6(1); 11.6(2); 11.6(1)ES01; 11.6(2)ES06; 11.6(1)ES02; 11.6(2)ES01; 11.6(2)ES03; 11.6(2)ES07; 11.6(2)ES08; 11.6(2)ES02; 11.6(2)ES05; 11.6(2)ES04 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*before 12.5\(1\)_su2_es05VulnerableCisco
  • cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:* Versions before 12.5\(1\)_su2_es05 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20232
  2. 2026-10-03 Alias added: GHSA-38hg-9xjj-pc2r

References

Patch 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-02838 Cisco Unified Contact Center Express Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2018-00362 Cross-site scripting in Cisco Unified Contact Center Express unknown CVSS 3.0CRITICAL 9.8
  • TI-2024-13188 Deserialization of untrusted data in Cisco Unified Contact Center Enterprise CVSS 3.1CRITICAL 10.0
  • TI-2025-14653 Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences