What does the Cisco HTTP client (help to) do on a switch?

Question

While checking for vulnerabilities in one of our Cisco switches I came upon this: CVE-2019-12665.

Excerpt from the CVE:

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel.

My understanding is that An HTTP-client communicates with an HTTP-server and there might be a switch in between (relaying the traffic). But I just don't understand the utility of having the switch acting as a client (or a server for that matter).

In the linked document, issued by Cisco, the "client feature" cannot even be disabled.

The standard HTTP 1.1 client and the secure HTTP client are always enabled. No commands exist to disable the HTTP client.

My question is: How and why does the switch contain, or offer the ability, to operate as a HTTP client (and/or server)? Why, when or how is this feature utilized?

Answer 1

How and why does the switch contain, or offer the ability, to operate as a HTTP client...

Simple, because "http:" and "https:" are valid references for actions. For example, copy...

troz-gw-1#copy ?
... (paired down)
  flash:          Copy from flash: file system
  ftp:            Copy from ftp: file system
  http:           Copy from http: file system
  https:          Copy from https: file system
  rcp:            Copy from rcp: file system
  scp:            Copy from scp: file system
  tftp:           Copy from tftp: file system
  xmodem:         Copy from xmodem: file system
  ymodem:         Copy from ymodem: file system

The DDNS service can use http. The callhome subsystem uses http. etc. etc.

Answer 2

Here's half an answer to your question, right from the same document:

Remote applications may require that you enable the HTTP server before using them. Applications that use the HTTP server include:

• Cisco web browser user interface, which uses the Cisco IOS XE Homepage Server, HTTP-based EXEC Server, and HTTP IOS File System
  (IFS) Server
• VPN Device Manager (VDM) application, which uses the VDM Server and the XML Session Manager (XSM)
• QoS Device Manager (QDM) application, which uses the QDM Server
• IP Phone and Cisco IOS XE Telephony Service applications, which use the ITS Local Directory Search and IOS Telephony Server (ITS)