PT-2023-4581 · Cisco · Cisco Unified Cm Session Management Edition+2

Published 2023-08-16 · Updated 2024-01-25 · CVE-2023-20242

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to the fixed version Cisco Unified CM Session Management Edition versions prior to the fixed version Cisco Unified Communications Manager IM & Presence Service versions prior to the fixed version

Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue exists because the interface does not properly validate user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive browser-based information.

Recommendations For Cisco Unified Communications Manager, update to a version that includes the fix for this issue. For Cisco Unified CM Session Management Edition, update to a version that includes the fix for this issue. For Cisco Unified Communications Manager IM & Presence Service, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04988

CVE-2023-20242

Affected Products

Cisco Unified Cm Session Management Edition

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im & Presence Service

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-imp-xss-QtT4VdsK · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-BFjSRJP5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04988 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20242 · Security Note
• https://twitter.com/CVEnew/status/1691921017336209565 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023082439 · Note
• https://t.me/cibsecurity/68697 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691871327412539671 · Twitter Post