CVE-2024-20405: XSS
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20405?
CVE-2024-20405 is classified as a critical vulnerability due to its potential for remote exploitation and the impact of stored XSS attacks.
How do I fix CVE-2024-20405?
To remediate CVE-2024-20405, ensure that your Cisco Finesse software is updated to the latest version that addresses the vulnerability.
Who is affected by CVE-2024-20405?
CVE-2024-20405 affects Cisco Finesse versions up to 11.6(1) and certain versions of 12.6(2).
What kind of attack can occur due to CVE-2024-20405?
CVE-2024-20405 allows an unauthenticated, remote attacker to conduct stored XSS attacks.
What is the root cause of CVE-2024-20405?
The vulnerability in CVE-2024-20405 is due to insufficient validation of user-supplied input for specific HTTP requests.