CVE-2020-3420— Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-3420
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.There are no workarounds that address this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Unified Communications Manager和Session Management Edition 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Unified Communications Manager（CUCM，Unified CM，CallManager）是美国思科（Cisco）公司的一款统一通信系统中的呼叫处理组件。该组件提供了一种可扩展、可分布和高可用的企业IP电话呼叫处理解决方案。Unified Communications Manager Session Management Edition是Unified Communications Manager的会话管理版。 Cisco CUCM和CUCM Session Man
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Unified Communications Manager | N/A | - |
II. Public POCs for CVE-2020-3420
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3420
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2024-11-18 · 28 CVEs total
| CVE-2020-27124 | 8.6 HIGH | Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service Vulnerability |
| CVE-2020-26071 | 8.4 HIGH | Cisco SD-WAN vEdge Arbitrary File Creation Vulnerability |
| CVE-2020-26074 | 7.8 HIGH | Cisco SD-WAN vManage Privilege Escalation Vulnerability |
| CVE-2020-26073 | 7.5 HIGH | Cisco SD-WAN vManage Directory Traversal Vulnerability |
| CVE-2021-1440 | 6.8 MEDIUM | Cisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service Vulnerabili |
| CVE-2021-1232 | 6.5 MEDIUM | Cisco SD-WAN vManage Information Disclosure Vulnerability |
| CVE-2021-1379 | 6.5 MEDIUM | Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Exe |
| CVE-2020-3539 | 6.3 MEDIUM | Cisco Data Center Network Manager Authorization Bypass Vulnerability |
| CVE-2021-1444 | 6.1 MEDIUM | Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) |
| CVE-2020-3431 | 6.1 MEDIUM | Cisco Small Business RV Series Routers Cross-Site Scripting Vulnerability |
| CVE-2020-26067 | 5.4 MEDIUM | Cisco Webex Teams Web Interface Cross-Site Scripting Vulnerability |
| CVE-2020-26063 | 5.4 MEDIUM | Cisco Integrated Management Controller Software Authorization Bypass Vulnerability |
| CVE-2020-3548 | 5.3 MEDIUM | Cisco Email Security Appliance Denial Of Service Vulnerability |
| CVE-2021-1424 | 5.3 MEDIUM | Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability |
| CVE-2021-1132 | 5.3 MEDIUM | Cisco Network Services Orchestrator Path Traversal Vulnerability |
| CVE-2021-1234 | 5.3 MEDIUM | Cisco SD-WAN vManage Information Disclosure Vulnerabilities |
| CVE-2020-26062 | 5.3 MEDIUM | Cisco Integrated Management Controller Username Enumeration Vulnerability |
| CVE-2021-1461 | 4.9 MEDIUM | Cisco SD-WAN Software Signature Verification Bypass Vulnerability |
| CVE-2020-3538 | 4.6 MEDIUM | Cisco Data Center Network Manager Path Traversal Vulnerability |
| CVE-2021-1410 | 4.3 MEDIUM | Cisco Webex Meetings Unauthorized Distribution List Update Vulnerability |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco Unified Communications Manager
- CVE-2026-20045
Cisco Unified Communications Products Remote Code Execution - CVE-2025-20361
Cisco Unified Communications Manager Stored Cross-Site Scrip - CVE-2025-20326
Cisco Unified Communications Manager Cross-Site Request Forg - CVE-2025-20309
Cisco Unified Communications Manager Static SSH Credentials - CVE-2024-20511
Cisco Unified Communications Manager Cross-Site Scripting Vu
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2020-3420
No comments yet