Cisco ECE Web UI XSS via Authenticated Remote Attack
CVE-2024-20367 Published on April 3, 2024
A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
Vulnerability Analysis
CVE-2024-20367 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2024-20367 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2024-20367
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-20367 are published in Cisco Enterprise Chat And Email:
Affected Versions
Cisco Enterprise Chat and Email:- Version 11.5(1) is affected.
- Version 11.6(1) is affected.
- Version 11.6(1)_ES2 is affected.
- Version 11.6(1)_ES3 is affected.
- Version 11.6(1)_ES4 is affected.
- Version 11.6(1)_ES5 is affected.
- Version 11.6(1)_ES6 is affected.
- Version 11.6(1)_ES10 is affected.
- Version 11.6(1)_ES11 is affected.
- Version 11.6(1)_ES7 is affected.
- Version 11.6(1)_ES8 is affected.
- Version 11.6(1)_ES9 is affected.
- Version 11.6(1)_ES9a is affected.
- Version 11.6(1)_ES12 is affected.
- Version 12.0(1) is affected.
- Version 12.0(1)_ES1 is affected.
- Version 12.0(1)_ES2 is affected.
- Version 12.0(1)_ES3 is affected.
- Version 12.0(1)_ES4 is affected.
- Version 12.0(1)_ES5 is affected.
- Version 12.0(1)_ES5a is affected.
- Version 12.0(1)_ES6 is affected.
- Version 12.0(1)_ES6_ET1 is affected.
- Version 12.0(1)_ES6_ET2 is affected.
- Version 12.0(1)_ES6_ET3 is affected.
- Version 12.0(1)_ES7 is affected.
- Version 12.0(1)_ES7_ET1 is affected.
- Version 12.5(1) is affected.
- Version 12.5(1)_ES1 is affected.
- Version 12.5(1)_ES2 is affected.
- Version 12.5(1)_ES3 is affected.
- Version 12.5(1)_ES3_ET1 is affected.
- Version 12.5(1)_ET1 is affected.
- Version 12.5(1)_ES4 is affected.
- Version 12.5(1)_ES3_ET2 is affected.
- Version 12.5(1)_ES4_ET1 is affected.
- Version 12.5(1)_ES5 is affected.
- Version 12.5(1)_ES5_ET1 is affected.
- Version 12.5(1)_ES6 is affected.
- Version 12.5(1)_ES7 is affected.
- Version 12.5(1)_ES8 is affected.
- Version 12.6(1) is affected.
- Version 12.6(1)_ET1 is affected.
- Version 12.6(1)_ET2 is affected.
- Version 12.6(1)_ES1 is affected.
- Version 12.6(1)_ET3 is affected.
- Version 12.6(1)_ES1_ET1 is affected.
- Version 12.6(1)_ES2 is affected.
- Version 12.6(1)_ES3 is affected.
- Version 12.6(1)_ES4 is affected.
- Version 12.6(1)_ES4_ET1 is affected.
- Version 12.6(1)_ES5 is affected.
- Version 12.6(1)_ES5_ET1 is affected.
- Version 12.6(1)_ES5_ET2 is affected.
- Version 12.6(1)_ES6 is affected.
- Version 12.6(1)_ES6_ET1 is affected.
- Version 12.6(1)_ES6_ET2 is affected.
- Version 12.6_ES2_ET1 is affected.
- Version 12.6_ES2_ET2 is affected.
- Version 12.6_ES2_ET3 is affected.
- Version 12.6_ES2_ET4 is affected.
- Version 12.6_ES3_ET1 is affected.
- Version 12.6_ES3_ET2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.