H3-2026-0054¶
Cisco Finesse Shindig Server-Side Request Forgery Vulnerability
| Category | VULNERABILITY |
| Base Score | 7.2 |
Description¶
Cisco Finesse embeds the Apache Shindig content proxy (/gadgets/proxy), which fetches an attacker-supplied URL server-side and returns the response to the unauthenticated caller. The proxy can be pointed at loopback-only services such as the Finesse REST API on 127.0.0.1:8082, whose SystemInfo response discloses the deployment type, primary and secondary node hostnames, and XMPP domain.
Impact¶
An unauthenticated attacker can read responses from loopback-only and internal network services through the Finesse server, enabling infrastructure enumeration and access to internal administrative interfaces that are not reachable externally.