WaratekVRT Sign in

CVE-2020-3282

Affected software3 products, listed below
Severity6.1 Medium CVSS 3.1 3 scores
WeaknessCross-site scripting (CWE-79)
Published2 Jul 2020
Updated17 Jun 2026

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 0.80% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N psirt@cisco.com Secondary
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Products and versions

3 products, 12 version entries
SourceVendorProductSchemeAffected versions
nvd cisco unified communications manager generic ≥ 10.5.2 and ＜ 10.5.2.10 · ≥ 11.5.1 and ＜ 11.5.1.8 · 12.0\(1\) · 12.5\(1\)
nvd cisco unified communications manager im and presence service generic ≥ 10.5.2 and ＜ 10.5.2.10 · ≥ 11.5.1 and ＜ 11.5.1.8 · 12.0\(1\) · 12.5\(1\)
nvd cisco unity connection generic ≥ 10.5.2 and ＜ 10.5.2.10 · ≥ 11.5.1 and ＜ 11.5.1.8 · 12.0\(1\) · 12.5\(1\)

References

URLTags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-cuc-imp-xss-OWuSYAp Vendor Advisory

Timeline
Published2020-07-02By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.