CVE-2023-20242 (unified_communications_manager, unified_communications_manager_im_and_presence_service)

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the …

amp attack cisco communications cross-site cve interface management manager presence scripting service session the web unauthenticated unified communications unified communications manager vulnerability web xss