CVE-2025-20377 | THREATINT

Description

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive information on the affected system that should be restricted. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.

PUBLISHED Reserved 2024-10-10 | Published 2025-11-05 | Updated 2025-11-05 | Assigner cisco

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status

unknown

12.5(1)

affected

11.0(1)

affected

12.0(1)

affected

11.0(2)

affected

11.5(1)

affected

10.5(1)

affected

10.5(2)

affected

11.6(2)

affected

10.5(1)_ES7

affected

11.6(1)

affected

10.5(2)_ES8

affected

12.6(1)

affected

12.5(2)

affected

12.6(2)

affected

15.0(1)

affected

Default status

unknown

12.6(1)ES3

affected

12.6(1)ES1

affected

12.6(1)

affected

12.6(1)ES2

affected

12.6(1)SecurityPatch

affected

12.5(1)ES1

affected

12.5(1)

affected

12.6(1)ES4

affected

11.0(1)

affected

10.5(1)

affected

12.0(1)

affected

10.5

affected

11.0

affected

11.5

affected

12.6(2)

affected

12.6(2)ES1

affected

12.6(2)ES2

affected

15.0(1)

affected

12.6(2)ES3

affected

15.0(1)ET01

affected

15.0(1)_SP1

affected

Default status

unknown

10.5(1)SU1

affected

10.6(1)

affected

11.6(1)

affected

10.6(1)SU1

affected

10.6(1)SU3

affected

11.6(2)

affected

12.0(1)

affected

11.0(1)SU1

affected

11.5(1)SU1

affected

10.5(1)

affected

12.5(1)

affected

12.5(1)SU1

affected

12.5(1)SU2

affected

12.5(1)SU3

affected

12.5(1)_SU03_ES01

affected

12.5(1)_SU03_ES02

affected

12.5(1)_SU02_ES03

affected

12.5(1)_SU02_ES04

affected

12.5(1)_SU02_ES02

affected

12.5(1)_SU01_ES02

affected

12.5(1)_SU01_ES03

affected

12.5(1)_SU02_ES01

affected

11.6(2)ES07

affected

11.6(2)ES08

affected

12.5(1)_SU01_ES01

affected

12.0(1)ES04

affected

12.5(1)ES02

affected

12.5(1)ES03

affected

11.6(2)ES06

affected

12.5(1)ES01

affected

12.0(1)ES03

affected

12.0(1)ES01

affected

11.6(2)ES05

affected

12.0(1)ES02

affected

11.6(2)ES04

affected

11.6(2)ES03

affected

11.6(2)ES02

affected

11.6(2)ES01

affected

10.6(1)SU3ES03

affected

11.0(1)SU1ES03

affected

10.6(1)SU3ES01

affected

10.5(1)SU1ES10

affected

11.5(1)SU1ES03

affected

11.6(1)ES02

affected

11.5(1)ES01

affected

10.6(1)SU2

affected

10.6(1)SU2ES04

affected

11.6(1)ES01

affected

10.6(1)SU3ES02

affected

11.5(1)SU1ES02

affected

11.5(1)SU1ES01

affected

11.0(1)SU1ES02

affected

12.5(1)_SU03_ES03

affected

12.5(1)_SU03_ES04

affected

12.5(1)_SU03_ES05

affected

UCCX 15.0.1

affected

12.5(1)_SU03_ES06

affected

Default status

unknown

11.6(1)

affected

10.5(1)

affected

11.0(1)

affected

11.5(1)

affected

12.0(1)

affected

12.5(1)

affected

11.0(2)

affected

12.6(1)

affected

12.5(1)SU

affected

12.6(1)_ET

affected

12.6(1)_ES05_ET

affected

11.0(3)

affected

12.6(2)

affected

12.6(2)_504_Issue_ET

affected

12.6.1_ExcelIssue_ET

affected

12.6(2)_Permalink_ET

affected

12.6.2_CSCwk19536_ET

affected

12.6.2_CSCwm96922_ET

affected

12.6.2_Amq_OOS_ET

affected

12.5(2)ET_CSCwi79933

affected

12.6(2)_ET

affected

12.6.2_CSCwn48501_ET

affected

15.0(1)

affected

12.6.2_CSCwp61293_ET

affected

12.6.2_CSCwp92614_ET

affected

References

sec.cloudapps.cisco.com/...ry/cisco-sa-cc-mult-vuln-gK4TFXSn (cisco-sa-cc-mult-vuln-gK4TFXSn)

cve.org (CVE-2025-20377)

nvd.nist.gov (CVE-2025-20377)

Download JSON