Cisco Unified Communications Manager and Session Management Edition Vulnerable to XSS Attacks

CVE-2020-3420

Summary

A cross-site scripting vulnerability exists in the web-based management interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. This issue stems from inadequate validation of user-supplied input, enabling an authenticated, remote attacker to inject malicious scripts into the interface. By exploiting this vulnerability, an attacker could execute arbitrary script code within the context of the interface or gain unauthorized access to sensitive browser-based information. There are currently no workarounds available to mitigate this vulnerability.

References