CVE-2024-20310

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an authenticated user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-23

Affected software

VendorProductVersions
CiscoCisco IOS XE SoftwareN/A
CiscoCisco Unified Communications Manager IM and Presence Service10.5(1); 10.5(2); 10.5(2a); 10.5(2b); 10.5(2)SU3; 10.5(2)SU2a; 10.5(2)SU4a; 10.5(2)SU4; 10.5(1)SU3; 10.5(1)SU1; 10.5(2)SU1; 10.5(2)SU2; 10.5(1)SU2; 11.5(1); 11.5(1)SU1; 11.5(1)SU2; 11.5(1)SU3; 11.5(1)SU3a; 11.5(1)SU4; 11.5(1)SU5
ciscounified_communications_manager_im_and_presence_service10.5\(1\)
ciscounified_communications_manager_im_and_presence_service10.5\(2\)
ciscounified_communications_manager_im_and_presence_service10.5\(2a\)
ciscounified_communications_manager_im_and_presence_service10.5\(2b\)
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su3
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su2a
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su4a
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su4
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su3
ciscounified_communications_manager_im_and_presence_service10.5\(1\)su1
ciscounified_communications_manager_im_and_presence_service10.5\(1\)su2
ciscounified_communications_manager_im_and_presence_service10.5\(1\)su1
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su1
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su2
ciscounified_communications_manager_im_and_presence_service10.5\(1\)su1
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su1
ciscounified_communications_manager_im_and_presence_service10.5\(2\)su2
ciscounified_communications_manager_im_and_presence_service10.5\(1\)su2
ciscounified_communications_manager_im_and_presence_service11.5\(1\)
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su11
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su2
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su3
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su3a
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su4
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su5
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su5a
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su6
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su7
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su8
ciscounified_communications_manager_im_and_presence_service11.5\(1\)su9
ciscounified_communications_manager_im_and_presence_service11.0\(1\)
ciscounified_communications_manager_im_and_presence_service11.0\(1\)su1
ciscounified_communications_manager_im_and_presence_service12.5\(1\)
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su1
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su2
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su3
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su4
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su5
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su6
ciscounified_communications_manager_im_and_presence_service12.5\(1\)su7
ciscounified_communications_manager_im_and_presence_service14.0
ciscounified_communications_manager_im_and_presence_service14.0su1
ciscounified_communications_manager_im_and_presence_service10.0\(1\)
ciscounified_communications_manager_im_and_presence_service10.0\(1\)su1
ciscounified_communications_manager_im_and_presence_service10.0\(1\)su2

References

Timeline

Published
Apr 3, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203117.5A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenCVE-2024-203127.4A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS Software and Cisco IOS XE Software could allCVE-2024-203137.4A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause aCVE-2024-203147.5A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could allow an unauthenticCVE-2024-203155.8A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allowCVE-2024-203165.3A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to accesCVE-2024-203177.4A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platCVE-2024-203187.4A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the linCVE-2024-203194.3A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured mCVE-2024-20323.1A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple usersCVE-2024-203207.8A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) CVE-2024-203218.6A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote
CVE-2024-20310: Medium severity, CVSS 6.1 | Vulnix