VDB
CVE-2022-20788
CVE-2022-20788
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
EPSS 0.32% · 55.4th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.32%
55.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | unity_connection | 12.5\(1\), 14.0 |
| cisco | unified_communications_manager | 11.5\(1\), 12.5\(1\), 14.0 |
| Cisco | Cisco Unified Communications Manager | n/a |
Exploit Intelligence
Timeline
- Apr 21, 2022 CVE Published
- Apr 22, 2022 EPSS Score
- Jun 11, 2022 EPSS Score
- Aug 1, 2022 EPSS Score
- Sep 20, 2022 EPSS Score
- Nov 9, 2022 EPSS Score
- Dec 29, 2022 EPSS Score
- Feb 17, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Jul 16, 2023 EPSS Score