CVE

CVE-2024-20404

7.2

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated to the affected device.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

cisco unified contact center enterprisecisco unified contact center expresscisco finessecisco packaged contact center enterprise

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

Cisco Finesse - Server-Side Request Forgery (SSRF)

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests. References: https://github.com/3zz4t/CVE-2024-20404 https://nvd.nist.gov/vuln/detail/CVE-2024-20404 Remediation: Apply the latest security patches and updates provided by Cisco for Finesse.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: cisco unified contact center enterprise

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →