Riskcovery

CVE-2021-1245

Cisco Finesse OpenSocial Gadget Editor Cross-Site Scripting Vulnerability

State
Published
Severity
6.5 Medium
Published
Jan 13, 2021
Updated
Sep 16, 2024
Reserved
Nov 13, 2020

Read the record on cve.org

Description

Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:Xcisco

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
Cisco Unified Customer Voice Portal (CVP)Cisco
  • 12.6(2)_ES4Affected
  • 12.6(2)_ET5Affected
  • 12.6(2)_ET7Affected
  • 12.6(2)_ET8Affected
  • 12.6(2)_ES9Affected
  • 12.6(2)_ES10Affected
  • 12.6(2)_ES11Affected
  • 12.6(2)_ET12Affected
  • 12.6(2)_ET13Affected
  • 12.6(2)_ES14Affected
  • 12.6(2)_ES15Affected
  • 12.6(2)_ET16Affected
  • 12.6(2)_ET17Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.