CVE-2020-3420

CVSS V2 None CVSS V3 None

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.There are no workarounds that address this vulnerability.

Overview

CVE ID
CVE-2020-3420

Assigner
cisco

Vulnerability Status
PUBLISHED

Published Version
2024-11-18T16:02:49.827Z

Last Modified Date
2024-11-18T16:23:32.040Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-bLZw4Ctq
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-rv-routers-xss-K7Z5U6q3

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2020-3420
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3420

History

Created	Old Value	New Value	Data Type	Notes
2024-11-19 12:03:15				Added to TrackCVE