← CVE Intelligence

CVE-2025-20114

Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability PUBLISHED

Description (CNA)

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

Affected (CNA)

Vendor / productVersions
Cisco / Cisco Unified Contact Center Expressaffected 10.6(1); affected 10.5(1)SU1; affected 10.6(1)SU3; affected 12.0(1); affected 10.0(1)SU1; affected 10.6(1)SU1; affected 11.0(1)SU1; affected 11.5(1)SU1; affected 10.5(1); affected 11.6(1); affected 11.6(2); affected 12.5(1); affected 12.5(1)SU1; affected 12.5(1)SU2; affected 12.5(1)SU3; affected 12.5(1)_SU03_ES01; affected 12.5(1)_SU03_ES02; affected 12.5(1)_SU02_ES03; affected 12.5(1)_SU02_ES04; affected 12.5(1)_SU02_ES02; affected 12.5(1)_SU01_ES02; affected 12.5(1)_SU01_ES03; affected 12.5(1)_SU02_ES01; affected 11.6(2)ES07; affected 11.6(2)ES08; affected 12.5(1)_SU01_ES01; affected 12.0(1)ES04; affected 12.5(1)ES02; affected 12.5(1)ES03; affected 11.6(2)ES06; affected 12.5(1)ES01; affected 12.0(1)ES03; affected 12.0(1)ES01; affected 11.6(2)ES05; affected 12.0(1)ES02; affected 11.6(2)ES04; affected 11.6(2)ES03; affected 11.6(2)ES02; affected 11.6(2)ES01; affected 10.6(1)SU3ES03; affected 11.0(1)SU1ES03; affected 10.6(1)SU3ES01; affected 10.5(1)SU1ES10; affected 10.0(1)SU1ES04; affected 11.5(1)SU1ES03; affected 11.6(1)ES02; affected 11.5(1)ES01; affected 9.0(2)SU3ES04; affected 10.6(1)SU2; affected 10.6(1)SU2ES04; affected 11.6(1)ES01; affected 10.6(1)SU3ES02; affected 11.5(1)SU1ES02; affected 11.5(1)SU1ES01; affected 8.5(1); affected 11.0(1)SU1ES02; affected 12.5(1)_SU03_ES03; affected 12.5(1)_SU03_ES04; affected 12.5(1)_SU03_ES05; affected 12.5(1)_SU03_ES06
Cisco / Cisco Unified Intelligence Centeraffected 11.6(1); affected 10.5(1); affected 11.0(1); affected 11.5(1); affected 12.0(1); affected 12.5(1); affected 11.0(2); affected 12.6(1); affected 12.5(1)SU; affected 12.6(1)_ET; affected 12.6(1)_ES05_ET; affected 11.0(3); affected 12.6(2); affected 12.6(2)_504_Issue_ET; affected 12.6.1_ExcelIssue_ET; affected 12.6(2)_Permalink_ET; affected 12.6.2_CSCwk19536_ET; affected 12.6.2_CSCwm96922_ET; affected 12.6.2_Amq_OOS_ET; affected 12.5(2)ET_CSCwi79933; affected 12.6(2)_ET; affected 12.6.2_CSCwn48501_ET

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.