While checking for vulnerabilities in one of our Cisco switches I came upon this: CVE-2019-12665.
Excerpt from the CVE:
A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel.
My understanding is that An HTTP-client communicates with an HTTP-server and there might be a switch in between (relaying the traffic). But I just don't understand the utility of having the switch acting as a client (or a server for that matter).
In the linked document, issued by Cisco, the "client feature" cannot even be disabled.
The standard HTTP 1.1 client and the secure HTTP client are always enabled. No commands exist to disable the HTTP client.
My question is: How and why does the switch contain, or offer the ability, to operate as a HTTP client (and/or server)? Why, when or how is this feature utilized?