PT-2021-7015 · Cisco · Cisco Unified Communications Manager+2
Published
2021-11-02
·
Updated
2022-05-04
·
CVE-2022-20788
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Communications Manager versions (affected versions not specified)
Cisco Unified Communications Manager Session Management Edition versions (affected versions not specified)
Cisco Unity Connection versions (affected versions not specified)
Description
The issue is related to the web-based management interface of the affected systems, which does not properly validate user-supplied input. This could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive browser-based information.
Recommendations
For Cisco Unified Communications Manager, update to a version that includes the fix for this issue.
For Cisco Unified Communications Manager Session Management Edition, update to a version that includes the fix for this issue.
For Cisco Unity Connection, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Avoid using the interface with untrusted input until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Unified Communications Manager
Cisco Unified Communications Manager Session Management Edition
Cisco Unity Connection