Skip to content
fr Sign in
4.8 Medium

CVE-2023-20242 A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco…

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected products and versions

Product Affected versions Fixed in
Cisco Unified Communications Manager 14 14SU1 → 14 No fix stated
Cisco Unified Communications Manager IM and Presence Service Versions not published
Cisco Unified Communications Manager / Cisco Unity Connection 11.0 11.0.1 → 11.0.5 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco Unified Communications Manager

The 62 CVEs of Cisco Unified Communications Manager →
CVE-2026-76419 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability 6.1 Medium CVE-2026-76481 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency… 7.5 High CVE-2026-76487 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session… 5.3 Medium CVE-2026-76479 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency… 7.8 High
Track this CVE