Riskcovery

CVE-2024-20405

State
Published
Severity
4.8 Medium
Published
Jun 5, 2024
Updated
Aug 1, 2024
Reserved
Nov 8, 2023

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Cisco Unified Contact Center EnterpriseCisco
  • N/AAffected
Cisco Unified Contact Center ExpressCisco
  • N/AAffected
Cisco FinesseCisco
  • 12.6(2)Affected
  • 12.6(2)ES1Affected
  • 12.6(2)ES2Affected
Cisco Packaged Contact Center EnterpriseCisco
  • N/AAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.