Product:
Cisco Unified Communications Manager
Summary
A vulnerability in the web-based management interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition could allow an authenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-20361 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. The attacker can inject malicious code into specific pages of the web-based management interface. Once the code is executed, it can run in the context of the affected interface, potentially allowing the attacker to access sensitive information or perform actions on behalf of the user.
Affected Products
- Cisco Unified Communications Manager: A web-based management interface that is vulnerable to cross-site scripting attacks due to improper input validation.
- Cisco Unified Communications Manager Session Management Edition: Similar to Unified CM, this product also has the same vulnerability in its web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that only trusted users have administrative access to the web-based management interface. Additionally, users should be educated about the risks of cross-site scripting and the importance of not interacting with suspicious links or content within the interface.