CVE-2024-20540: Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into a specific page of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. To exploit this vulnerability, the attacker must have at least a Supervisor role on an affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20540?
CVE-2024-20540 is categorized as a medium severity vulnerability.
How do I fix CVE-2024-20540?
To fix CVE-2024-20540, ensure that you apply the latest security patches released by Cisco for the Unified Contact Center Management Portal.
Who is affected by CVE-2024-20540?
CVE-2024-20540 affects users of the Cisco Unified Contact Center Management Portal who have access to the web-based management interface.
What type of attack is possible with CVE-2024-20540?
CVE-2024-20540 allows an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack.
What should I do if I have been exploited by CVE-2024-20540?
If you believe you have been exploited due to CVE-2024-20540, you should initiate a security incident response and review your system for any unauthorized changes.