CVE-2016-6426

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGH
EPSS
0.2%
top 52.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Unified Contact Center ExpressCisco Unified Intelligence Center
Timeline
PublishedOct 5
Latest updateMay 17

Description

The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/unified_intelligence_center8.5.4, 9.0\(2\), 9.1\(1\)+2

🔴Vulnerability Details

2
GHSA
GHSA-rc67-hjj5-jc2r: The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8↗2022-05-17
▶
CVEList
CVE-2016-6426: The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8↗2016-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Intelligence Center (CUIC) Software Unauthenticated User Account Creation Vulnerability↗2016-10-05
▶
CVE-2016-6426 (HIGH CVSS 7.5) | The j_spring_security_switch_user f | cvebase.io