CVE-2025-20361: Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20361?
The severity of CVE-2025-20361 is classified as high due to its potential to allow an attacker to execute malicious scripts on affected systems.
How do I fix CVE-2025-20361?
To fix CVE-2025-20361, it's recommended to apply the latest security patches provided by Cisco for both Unified Communications Manager and Unified Communications Manager Session Management Edition.
What products are affected by CVE-2025-20361?
CVE-2025-20361 affects Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition.
What type of attack is associated with CVE-2025-20361?
CVE-2025-20361 is associated with a cross-site scripting (XSS) attack that can be executed by an authenticated, remote attacker.
Who can exploit CVE-2025-20361?
CVE-2025-20361 can be exploited by an authenticated remote attacker who has access to the web-based management interface of the affected Cisco products.