5.4

CVE-2023-20133

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

 This vulnerability exists because of insufficient validation of user-supplied input in Webex Events (classic) programs, email templates, and survey questions. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Webex Meetings Version 39.6
Cisco ≫ Webex Meetings Version 39.7
Cisco ≫ Webex Meetings Version 39.7.4
Cisco ≫ Webex Meetings Version 39.7.7
Cisco ≫ Webex Meetings Version 39.8
Cisco ≫ Webex Meetings Version 39.8.2
Cisco ≫ Webex Meetings Version 39.8.3
Cisco ≫ Webex Meetings Version 39.8.4
Cisco ≫ Webex Meetings Version 39.9
Cisco ≫ Webex Meetings Version 39.9.1
Cisco ≫ Webex Meetings Version 39.10
Cisco ≫ Webex Meetings Version 39.11
Cisco ≫ Webex Meetings Version 40.1
Cisco ≫ Webex Meetings Version 40.2
Cisco ≫ Webex Meetings Version 40.4
Cisco ≫ Webex Meetings Version 40.4.10
Cisco ≫ Webex Meetings Version 40.6
Cisco ≫ Webex Meetings Version 40.6.2
Cisco ≫ Webex Meetings Version 42.6
Cisco ≫ Webex Meetings Version 42.7
Cisco ≫ Webex Meetings Version 42.8
Cisco ≫ Webex Meetings Version 42.9
Cisco ≫ Webex Meetings Version 42.10
Cisco ≫ Webex Meetings Version 42.11
Cisco ≫ Webex Meetings Version 42.12
Cisco ≫ Webex Meetings Version 43.1
Cisco ≫ Webex Meetings Version 43.2
Cisco ≫ Webex Meetings Version 43.3
Cisco ≫ Webex Meetings Version 43.4
Cisco ≫ Webex Meetings Version 43.4.1
Cisco ≫ Webex Meetings Version 43.4.2
Cisco ≫ Webex Meetings Version 43.5.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.464
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Cisco PSIRT 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6
Vendor Advisory