CVE-2024-20405
MEDIUM 6.1EPSS 0.6%
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.
- Affected
- Cisco · Cisco Unified Contact Center Enterprise · Cisco Unified Contact Center Express · Cisco Finesse · Cisco Packaged Contact Center Enterprise
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1 CISCO
- 4.8 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.65% chance of exploitation in the next 30 days, 50th percentile
- Published
- 2024-06-05
- Updated
- 2024-08-01
Proof-of-concept exploits (2)
- AbdElRahmanEzzat1995/CVE-2024-204051★ · 2024-06-09
- 3zz4t/CVE-2024-204051★ · 2024-06-09