CVE-2023-20096: Cisco Unified Contact Center Express Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. This vulnerability is due to insufficient input validation of user-supplied data. An attacker could exploit this vulnerability by entering crafted text into various input fields within the web-based management interface. A successful exploit could allow the attacker to perform a stored XSS attack, which could allow the execution of scripts within the context of other users of the interface.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-20096?
CVE-2023-20096 is a vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) that allows an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack.
How does CVE-2023-20096 occur?
CVE-2023-20096 occurs due to insufficient input validation of user-supplied data in the web-based management interface of Cisco Unified Contact Center Express.
What is the severity of CVE-2023-20096?
The severity of CVE-2023-20096 is medium with a CVSS score of 5.4.
Which software is affected by CVE-2023-20096?
Cisco Unified Contact Center Express versions up to and inclusive of 12.5(1)su3 are affected by CVE-2023-20096.
How can CVE-2023-20096 be fixed?
To fix CVE-2023-20096, it is recommended to apply the necessary updates or patches provided by Cisco.