Vulnerability Intelligence Report

CVE-2023-20242

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

No Active Exploit Signals

CVSS Base Score

4.8

MEDIUM

Exploitability:1.7

Impact Score:2.8

EPSS Probability:0.39%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

CWE-79 ↗Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products & Versions

Vendor	Product	Affected Versions
Cisco	Cisco Unified Communications Manager	12.0(1)SU1 (affected), 12.0(1)SU2 (affected), 12.0(1)SU3 (affected), 12.0(1)SU4 (affected), 12.0(1)SU5 (affected), 12.5(1) (affected), 12.5(1)SU1 (affected), 12.5(1)SU2 (affected), 12.5(1)SU3 (affected), 12.5(1)SU4 (affected), 12.5(1)SU5 (affected), 12.5(1)SU6 (affected), 12.5(1)SU7 (affected), 12.5(1)SU7a (affected), 12.5(1)SU8 (affected), 14 (affected), 14SU1 (affected), 14SU2 (affected), 14SU3 (affected)
Cisco	Cisco Unified Communications Manager IM and Presence Service	N/A (affected)
Cisco	Cisco Unified Communications Manager / Cisco Unity Connection	10.5(2)SU10 (affected), 10.5(1) (affected), 10.5(1)SU1 (affected), 10.5(1)SU1a (affected), 10.5(2) (affected), 10.5(2)SU1 (affected), 10.5(2)SU2 (affected), 10.5(2)SU3 (affected), 10.5(2)SU4 (affected), 10.5(2)SU5 (affected), 10.5(2)SU6 (affected), 10.5(2)SU7 (affected), 10.5(2)SU8 (affected), 10.5(2)SU9 (affected), 10.5(2)SU2a (affected), 10.5(2)SU3a (affected), 10.5(2)SU4a (affected), 10.5(2)SU6a (affected), 11.0(1) (affected), 11.0(1a) (affected), 11.0(1a)SU1 (affected), 11.0(1a)SU2 (affected), 11.0(1a)SU3 (affected), 11.0(1a)SU3a (affected), 11.0(1a)SU4 (affected), 11.0.1 (affected), 11.0.2 (affected), 11.0.5 (affected), 11.5(1) (affected), 11.5(1)SU1 (affected), 11.5(1)SU2 (affected), 11.5(1)SU3 (affected), 11.5(1)SU3a (affected), 11.5(1)SU3b (affected), 11.5(1)SU4 (affected), 11.5(1)SU5 (affected), 11.5(1)SU6 (affected), 11.5(1)SU7 (affected), 11.5(1)SU8 (affected), 11.5(1)SU9 (affected), 11.5(1)SU10 (affected), 11.5(1)SU11 (affected), 10.0(1)SU2 (affected), 10.0(1) (affected), 10.0(1)SU1 (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

0.394%

GitHub Advisory

GHSA-2prg-gf64-mf8x ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	Cisco Systems, Inc. · Hosted Service · USA
Reserved	2022-10-27T18:47:50
Published	2023-08-16T20:59:25
Last Updated	2024-08-02T09:05:35

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2023-20242

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2023-20242

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE