CVE-2024-20488
21.08.2024, 19:15
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
| Vendor | Product | Version |
|---|---|---|
| cisco | unified_communications_manager | 12.5\(1\) |
| cisco | unified_communications_manager | 12.5\(1\)su1 |
| cisco | unified_communications_manager | 12.5\(1\)su2 |
| cisco | unified_communications_manager | 12.5\(1\)su3 |
| cisco | unified_communications_manager | 12.5\(1\)su4 |
| cisco | unified_communications_manager | 12.5\(1\)su5 |
| cisco | unified_communications_manager | 12.5\(1\)su6 |
| cisco | unified_communications_manager | 12.5\(1\)su7 |
| cisco | unified_communications_manager | 12.5\(1\)su7a |
| cisco | unified_communications_manager | 12.5\(1\)su8 |
| cisco | unified_communications_manager | 12.5\(1\)su8a |
| cisco | unified_communications_manager | 12.5\(1\)su9 |
| cisco | unified_communications_manager | 12.6\(1\) |
| cisco | unified_communications_manager | 14.0 |
| cisco | unified_communications_manager | 14.0su1:su1 |
| cisco | unified_communications_manager | 14.0su2:su2 |
| cisco | unified_communications_manager | 14.0su2a:su2a |
| cisco | unified_communications_manager | 14.0su3:su3 |
| cisco | unified_communications_manager | 14.0su4:su4 |
| cisco | unified_communications_manager | 14.0su4a:su4a |
| cisco | unified_communications_manager | 15.0 |
𝑥
= Vulnerable software versions