[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJMAb1qK5G4MkGfmrNXg3pTQ-lQMQFZoPy4ZuU7EIxeE":3,"g5a-risk:CVE-2023-20259":138},{"success":4,"data":5,"meta":135},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":37,"epssPercentile":26,"epssTimeSeries":38,"severity":39,"affectedProducts":40,"affectedProductsCount":63,"references":64,"referencesCount":70,"weaknesses":71,"weaknessesCount":70,"isActivelyExploited":80,"cisaInfo":26,"otxData":26,"relatedBlogPosts":81,"seoMetadata":82,"configurations":107,"relatedVendorCves":133,"notableEvents":134},"CVE-2023-20259","What is CVE-2023-20259?","A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call processing. This API is not used for device management and is unlikely to be used in normal operations of the device.\r\n\r This vulnerability is due to improper API authentication and incomplete validation of the API request. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to high CPU utilization, which could negatively impact user traffic and management access. When the attack stops, the device will recover without manual intervention.","A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utiliz...","2023-10-04T17:15:09.99","2024-01-25T17:15:41.753",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":26,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":36},"ykramarz@cisco.com","Secondary",{"Version":20,"VectorString":33,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":34,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":35,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:N\u002FI:N\u002FA:H","CHANGED",8.6,4,0.00808,[37,37,37,37,37,37,37],"High",[41,46,49,53,55,58,60],{"vendor":42,"product":43,"version":44,"criteria":45,"vulnerable":4},"cisco","emergency_responder","14su3","cpe:2.3:a:cisco:emergency_responder:14su3:*:*:*:*:*:*:*",{"vendor":42,"product":47,"version":44,"criteria":48,"vulnerable":4},"prime_collaboration_deployment","cpe:2.3:a:cisco:prime_collaboration_deployment:14su3:*:*:*:*:*:*:*",{"vendor":42,"product":50,"version":51,"criteria":52,"vulnerable":4},"unified_communications_manager","12.5\\(1\\)su7","cpe:2.3:a:cisco:unified_communications_manager:12.5\\(1\\)su7:*:*:*:*:*:*:*",{"vendor":42,"product":50,"version":44,"criteria":54,"vulnerable":4},"cpe:2.3:a:cisco:unified_communications_manager:14su3:*:*:*:*:*:*:*",{"vendor":42,"product":56,"version":51,"criteria":57,"vulnerable":4},"unified_communications_manager_im_\\&_presence_service","cpe:2.3:a:cisco:unified_communications_manager_im_\\&_presence_service:12.5\\(1\\)su7:*:*:*:*:*:*:*",{"vendor":42,"product":56,"version":44,"criteria":59,"vulnerable":4},"cpe:2.3:a:cisco:unified_communications_manager_im_\\&_presence_service:14su3:*:*:*:*:*:*:*",{"vendor":42,"product":61,"version":44,"criteria":62,"vulnerable":4},"unity_connection","cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*",7,[65],{"url":66,"source":67,"tags":68},"https:\u002F\u002Fsec.cloudapps.cisco.com\u002Fsecurity\u002Fcenter\u002Fcontent\u002FCiscoSecurityAdvisory\u002Fcisco-sa-cucm-apidos-PGsDcdNF","Cisco",[69],"Vendor Advisory",1,[72],{"id":73,"name":74,"description":75,"extendedDescription":76,"status":77,"abstraction":78,"structure":79},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.","Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.\nThere are at least three distinct scenarios which can commonly lead to resource exhaustion:\nResource exhaustion problems are often result due to an incorrect implementation of the following situations:","Draft","Class","Simple",false,[],{"title":83,"metaDescription":84,"keywords":85,"canonicalUrl":86,"structuredData":87},"What is CVE-2023-20259? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-20259, a high severity cyber security vulnerability from 2023. A vulnerability in an API endpoint of multiple Cisco Unifie...","CVE-2023-20259, CVE-2023-20259 vulnerability, CVE-2023-20259 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, cisco security, emergency_responder vulnerability, prime_collaboration_deployment vulnerability, unified_communications_manager vulnerability, unified_communications_manager_im_\\&_presence_service vulnerability, unity_connection vulnerability","\u002Fwhat-is\u002Fcve-2023-20259",{"@context":88,"@type":89,"headline":83,"description":84,"datePublished":10,"dateModified":11,"author":90,"publisher":94,"about":98,"mainEntityOfPage":102,"articleSection":105,"keywords":106},"https:\u002F\u002Fschema.org","TechArticle",{"@type":91,"name":92,"url":93},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":91,"name":92,"url":93,"logo":95},{"@type":96,"url":97},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":99,"name":6,"description":100,"additionalType":101},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":103,"@id":104},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-20259","Cybersecurity","CVE-2023-20259, CVE-2023-20259 vulnerability, CVE-2023-20259 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[108],{"Operator":26,"Negate":26,"Nodes":109},[110],{"Operator":111,"Negate":26,"CPEMatch":112},"OR",[113,115,117,119,122,124,127,129,131],{"Vulnerable":4,"Criteria":45,"MatchCriteriaID":114,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"CF848485-44D0-4354-852A-8E859E050A07",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":116,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"9399AD59-4F8E-4B8E-AF9B-F2785993DBC8",{"Vulnerable":4,"Criteria":52,"MatchCriteriaID":118,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"397E6105-7508-4DEB-AD6D-1E702E31C875",{"Vulnerable":4,"Criteria":120,"MatchCriteriaID":121,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:cisco:unified_communications_manager:12.5\\(1\\)su7:*:*:*:session_management:*:*:*","94FFAF94-86EC-468C-A7F9-D85D3DE86A85",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":123,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"D4FFC030-F8FD-486F-83C5-4C8F2932CE5F",{"Vulnerable":4,"Criteria":125,"MatchCriteriaID":126,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"cpe:2.3:a:cisco:unified_communications_manager:14su3:*:*:*:session_management:*:*:*","EB4AF502-94FF-4CCF-B99F-A4AEDE032128",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":128,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"E0B6DA5E-39BB-40B5-8BB6-30E77F89DE79",{"Vulnerable":4,"Criteria":59,"MatchCriteriaID":130,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"4CD16AB0-3BB8-4ECF-B0F8-B7AE8B41BF87",{"Vulnerable":4,"Criteria":62,"MatchCriteriaID":132,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"181866CE-6279-4422-8EF8-7A12DB5B21F6",[],[],{"lastModified":11,"cacheTime":136,"version":137},1792361943298,"2.0",{"score":139,"band":140,"action":141,"scoredAt":142},47,"Medium","Plan remediation","2026-10-16T06:59:18.831231+00:00"]