CVE-2025-20374 (GCVE-0-2025-20374)
Vulnerability from cvelistv5
Published
2025-11-05 16:31
Modified
2025-11-05 20:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.
This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco Unified Contact Center Express |
Version: 10.5(1)SU1 Version: 10.6(1) Version: 11.6(1) Version: 10.6(1)SU1 Version: 10.6(1)SU3 Version: 11.6(2) Version: 12.0(1) Version: 11.0(1)SU1 Version: 11.5(1)SU1 Version: 10.5(1) Version: 12.5(1) Version: 12.5(1)SU1 Version: 12.5(1)SU2 Version: 12.5(1)SU3 Version: 12.5(1)_SU03_ES01 Version: 12.5(1)_SU03_ES02 Version: 12.5(1)_SU02_ES03 Version: 12.5(1)_SU02_ES04 Version: 12.5(1)_SU02_ES02 Version: 12.5(1)_SU01_ES02 Version: 12.5(1)_SU01_ES03 Version: 12.5(1)_SU02_ES01 Version: 11.6(2)ES07 Version: 11.6(2)ES08 Version: 12.5(1)_SU01_ES01 Version: 12.0(1)ES04 Version: 12.5(1)ES02 Version: 12.5(1)ES03 Version: 11.6(2)ES06 Version: 12.5(1)ES01 Version: 12.0(1)ES03 Version: 12.0(1)ES01 Version: 11.6(2)ES05 Version: 12.0(1)ES02 Version: 11.6(2)ES04 Version: 11.6(2)ES03 Version: 11.6(2)ES02 Version: 11.6(2)ES01 Version: 10.6(1)SU3ES03 Version: 11.0(1)SU1ES03 Version: 10.6(1)SU3ES01 Version: 10.5(1)SU1ES10 Version: 11.5(1)SU1ES03 Version: 11.6(1)ES02 Version: 11.5(1)ES01 Version: 10.6(1)SU2 Version: 10.6(1)SU2ES04 Version: 11.6(1)ES01 Version: 10.6(1)SU3ES02 Version: 11.5(1)SU1ES02 Version: 11.5(1)SU1ES01 Version: 11.0(1)SU1ES02 Version: 12.5(1)_SU03_ES03 Version: 12.5(1)_SU03_ES04 Version: 12.5(1)_SU03_ES05 Version: UCCX 15.0.1 Version: 12.5(1)_SU03_ES06 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-20374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T20:10:38.672178Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T20:11:12.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Unified Contact Center Express",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "10.5(1)SU1"
},
{
"status": "affected",
"version": "10.6(1)"
},
{
"status": "affected",
"version": "11.6(1)"
},
{
"status": "affected",
"version": "10.6(1)SU1"
},
{
"status": "affected",
"version": "10.6(1)SU3"
},
{
"status": "affected",
"version": "11.6(2)"
},
{
"status": "affected",
"version": "12.0(1)"
},
{
"status": "affected",
"version": "11.0(1)SU1"
},
{
"status": "affected",
"version": "11.5(1)SU1"
},
{
"status": "affected",
"version": "10.5(1)"
},
{
"status": "affected",
"version": "12.5(1)"
},
{
"status": "affected",
"version": "12.5(1)SU1"
},
{
"status": "affected",
"version": "12.5(1)SU2"
},
{
"status": "affected",
"version": "12.5(1)SU3"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES01"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES02"
},
{
"status": "affected",
"version": "12.5(1)_SU02_ES03"
},
{
"status": "affected",
"version": "12.5(1)_SU02_ES04"
},
{
"status": "affected",
"version": "12.5(1)_SU02_ES02"
},
{
"status": "affected",
"version": "12.5(1)_SU01_ES02"
},
{
"status": "affected",
"version": "12.5(1)_SU01_ES03"
},
{
"status": "affected",
"version": "12.5(1)_SU02_ES01"
},
{
"status": "affected",
"version": "11.6(2)ES07"
},
{
"status": "affected",
"version": "11.6(2)ES08"
},
{
"status": "affected",
"version": "12.5(1)_SU01_ES01"
},
{
"status": "affected",
"version": "12.0(1)ES04"
},
{
"status": "affected",
"version": "12.5(1)ES02"
},
{
"status": "affected",
"version": "12.5(1)ES03"
},
{
"status": "affected",
"version": "11.6(2)ES06"
},
{
"status": "affected",
"version": "12.5(1)ES01"
},
{
"status": "affected",
"version": "12.0(1)ES03"
},
{
"status": "affected",
"version": "12.0(1)ES01"
},
{
"status": "affected",
"version": "11.6(2)ES05"
},
{
"status": "affected",
"version": "12.0(1)ES02"
},
{
"status": "affected",
"version": "11.6(2)ES04"
},
{
"status": "affected",
"version": "11.6(2)ES03"
},
{
"status": "affected",
"version": "11.6(2)ES02"
},
{
"status": "affected",
"version": "11.6(2)ES01"
},
{
"status": "affected",
"version": "10.6(1)SU3ES03"
},
{
"status": "affected",
"version": "11.0(1)SU1ES03"
},
{
"status": "affected",
"version": "10.6(1)SU3ES01"
},
{
"status": "affected",
"version": "10.5(1)SU1ES10"
},
{
"status": "affected",
"version": "11.5(1)SU1ES03"
},
{
"status": "affected",
"version": "11.6(1)ES02"
},
{
"status": "affected",
"version": "11.5(1)ES01"
},
{
"status": "affected",
"version": "10.6(1)SU2"
},
{
"status": "affected",
"version": "10.6(1)SU2ES04"
},
{
"status": "affected",
"version": "11.6(1)ES01"
},
{
"status": "affected",
"version": "10.6(1)SU3ES02"
},
{
"status": "affected",
"version": "11.5(1)SU1ES02"
},
{
"status": "affected",
"version": "11.5(1)SU1ES01"
},
{
"status": "affected",
"version": "11.0(1)SU1ES02"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES03"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES04"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES05"
},
{
"status": "affected",
"version": "UCCX 15.0.1"
},
{
"status": "affected",
"version": "12.5(1)_SU03_ES06"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.\r\n\r\nThis vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system.\u0026nbsp;To exploit this vulnerability, the attacker must have valid administrative credentials."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T16:31:23.862Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-cc-mult-vuln-gK4TFXSn",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn"
}
],
"source": {
"advisory": "cisco-sa-cc-mult-vuln-gK4TFXSn",
"defects": [
"CSCwq36596"
],
"discovery": "EXTERNAL"
},
"title": "Cisco Unified Contact Center Express Arbitrary File Download Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2025-20374",
"datePublished": "2025-11-05T16:31:23.862Z",
"dateReserved": "2024-10-10T19:15:13.262Z",
"dateUpdated": "2025-11-05T20:11:12.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-20374\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-11-05T17:15:38.457\",\"lastModified\":\"2025-11-17T19:40:48.957\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.\\r\\n\\r\\nThis vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system.\u0026nbsp;To exploit this vulnerability, the attacker must have valid administrative credentials.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.5\\\\(1\\\\)_su03_es07\",\"matchCriteriaId\":\"6EF18C21-6E70-4748-99FA-884754F44D1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:unified_contact_center_express:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"124C88AE-ED0C-4CBC-A84D-200EDB776C8C\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Cisco Unified Contact Center Express Arbitrary File Download Vulnerability\", \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 4.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.\\r\\n\\r\\nThis vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system.\u0026nbsp;To exploit this vulnerability, the attacker must have valid administrative credentials.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn\", \"name\": \"cisco-sa-cc-mult-vuln-gK4TFXSn\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"source\": {\"advisory\": \"cisco-sa-cc-mult-vuln-gK4TFXSn\", \"discovery\": \"EXTERNAL\", \"defects\": [\"CSCwq36596\"]}, \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"type\": \"cwe\", \"cweId\": \"CWE-22\"}]}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Unified Contact Center Express\", \"versions\": [{\"version\": \"10.5(1)SU1\", \"status\": \"affected\"}, {\"version\": \"10.6(1)\", \"status\": \"affected\"}, {\"version\": \"11.6(1)\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU1\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU3\", \"status\": \"affected\"}, {\"version\": \"11.6(2)\", \"status\": \"affected\"}, {\"version\": \"12.0(1)\", \"status\": \"affected\"}, {\"version\": \"11.0(1)SU1\", \"status\": \"affected\"}, {\"version\": \"11.5(1)SU1\", \"status\": \"affected\"}, {\"version\": \"10.5(1)\", \"status\": \"affected\"}, {\"version\": \"12.5(1)\", \"status\": \"affected\"}, {\"version\": \"12.5(1)SU1\", \"status\": \"affected\"}, {\"version\": \"12.5(1)SU2\", \"status\": \"affected\"}, {\"version\": \"12.5(1)SU3\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES01\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES02\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU02_ES03\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU02_ES04\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU02_ES02\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU01_ES02\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU01_ES03\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU02_ES01\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES07\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES08\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU01_ES01\", \"status\": \"affected\"}, {\"version\": \"12.0(1)ES04\", \"status\": \"affected\"}, {\"version\": \"12.5(1)ES02\", \"status\": \"affected\"}, {\"version\": \"12.5(1)ES03\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES06\", \"status\": \"affected\"}, {\"version\": \"12.5(1)ES01\", \"status\": \"affected\"}, {\"version\": \"12.0(1)ES03\", \"status\": \"affected\"}, {\"version\": \"12.0(1)ES01\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES05\", \"status\": \"affected\"}, {\"version\": \"12.0(1)ES02\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES04\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES03\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES02\", \"status\": \"affected\"}, {\"version\": \"11.6(2)ES01\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU3ES03\", \"status\": \"affected\"}, {\"version\": \"11.0(1)SU1ES03\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU3ES01\", \"status\": \"affected\"}, {\"version\": \"10.5(1)SU1ES10\", \"status\": \"affected\"}, {\"version\": \"11.5(1)SU1ES03\", \"status\": \"affected\"}, {\"version\": \"11.6(1)ES02\", \"status\": \"affected\"}, {\"version\": \"11.5(1)ES01\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU2\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU2ES04\", \"status\": \"affected\"}, {\"version\": \"11.6(1)ES01\", \"status\": \"affected\"}, {\"version\": \"10.6(1)SU3ES02\", \"status\": \"affected\"}, {\"version\": \"11.5(1)SU1ES02\", \"status\": \"affected\"}, {\"version\": \"11.5(1)SU1ES01\", \"status\": \"affected\"}, {\"version\": \"11.0(1)SU1ES02\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES03\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES04\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES05\", \"status\": \"affected\"}, {\"version\": \"UCCX 15.0.1\", \"status\": \"affected\"}, {\"version\": \"12.5(1)_SU03_ES06\", \"status\": \"affected\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-11-05T16:31:23.862Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20374\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-05T20:10:38.672178Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-05T20:10:43.732Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2025-20374\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"cisco\", \"dateReserved\": \"2024-10-10T19:15:13.262Z\", \"datePublished\": \"2025-11-05T16:31:23.862Z\", \"dateUpdated\": \"2025-11-05T20:11:12.630Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…