PT-2022-3507 · Cisco · Cisco Unified Communications Manager Im & Presence Service+3

Cristian Mocanu · Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-20800

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions (affected versions not specified) Cisco Unified Communications Manager Session Management Edition versions (affected versions not specified) Cisco Unified Communications Manager IM & Presence Service versions (affected versions not specified) Cisco Unity Connection versions (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue exists because the interface does not properly validate user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive browser-based information.

Recommendations For Cisco Unified Communications Manager, update to a version that properly validates user-supplied input in the web-based management interface. For Cisco Unified Communications Manager Session Management Edition, update to a version that properly validates user-supplied input in the web-based management interface. For Cisco Unified Communications Manager IM & Presence Service, update to a version that properly validates user-supplied input in the web-based management interface. For Cisco Unity Connection, update to a version that properly validates user-supplied input in the web-based management interface. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04288

CVE-2022-20800

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im & Presence Service

Cisco Unified Communications Manager Session Management Edition

Cisco Unity Connection

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-RgH7MpKA · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20800 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20800 · Vendor Advisory
• https://t.me/cibsecurity/45707 · Telegram Post