Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2024-20512: Cisco Unified CCMP: Unauthenticated Cross-Site Scripting Risk
CVE-2024-20512 · published 2 years ago
Summary
An attacker can trick a user into clicking a malicious link, allowing them to execute unauthorized code or access sensitive information. This affects Cisco Unified CCMP's web-based management interface. To mitigate this risk, ensure users are cautious when clicking links and consider implementing additional security measures to validate user input.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | unified_contact_center_management_portal |
>= 12.6\(1\), < 12.6\(1\)_es13 cpe:2.3:a:cisco:unified_contact_center_management_portal:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote attacker to conduct a reflected cross-s...
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-20512 · NVD
Track software like this
Free during beta