Cisco BroadWorks Hosted Thin Receptionist Vulnerability Could Lead to XSS Attacks

CVE-2022-20948

What is CVE-2022-20948?

A vulnerability in the web management interface of Cisco BroadWorks Hosted Thin Receptionist enables authenticated, remote attackers to conduct cross-site scripting (XSS) attacks. This security issue arises from insufficient validation of user input, allowing potential exploitation when a user is tricked into clicking a crafted link. If successful, an attacker could execute arbitrary scripts in the context of the affected interface, leading to unauthorized access to sensitive browser-based information. Cisco has provided software updates to mitigate this issue. No workaround exists to protect against this vulnerability.

References