CVE-2023-20265

🗓️ 21 Nov 2023 18:45:33Reported by ciscoType

Cisco IP Phones web-based management interface authenticated remote stored XSS vulnerability

Reporter	Title	Published	Views	Family All 12
Cisco	Cisco IP Phone Stored Cross-Site Scripting Vulnerability	15 Nov 202316:00	–	cisco
Tenable Nessus	Cisco IP Phone Stored XSS (cisco-sa-uipphone-xss-NcmUykqA)	6 Dec 202300:00	–	nessus
Tenable Nessus	Cisco IP Phones Stored Cross-Site Scripting (CVE-2023-20265)	18 Mar 202400:00	–	nessus
CNNVD	Cisco IP Phone 安全漏洞	21 Nov 202300:00	–	cnnvd
CNVD	Cisco IP Phone Cross-Site Scripting Vulnerability	24 Nov 202300:00	–	cnvd
Cvelist	CVE-2023-20265	21 Nov 202318:45	–	cvelist
EUVD	EUVD-2023-24444	3 Oct 202520:07	–	euvd
NVD	CVE-2023-20265	21 Nov 202319:15	–	nvd
Prion	Cross site scripting	21 Nov 202319:15	–	prion
Positive Technologies	PT-2023-7112 · Cisco · Cisco Ip Phones	15 Nov 202300:00	–	ptsecurity

NVD

Node

cisco ip_dect_110_firmwareRange<5.1.2sr1

AND

cisco ip_dect_110Match-

Node

cisco ip_dect_210_firmwareRange<5.1.2sr1

AND

cisco ip_dect_210Match-

Node

cisco unified_ip_phone_6901_firmwareRange9.0–9.3(1)sr3

AND

cisco unified_ip_phone_6901Match-

Node

cisco unified_sip_phone_3905_firmwareRange9.0–9.4(1)sr4

AND

cisco unified_sip_phone_3905Match-

[
  {
    "vendor": "Cisco",
    "product": "Cisco IP Phones with Multiplatform Firmware",
    "versions": [
      {
        "version": "4.5",
        "status": "affected"
      },
      {
        "version": "4.6 MSR1",
        "status": "affected"
      },
      {
        "version": "4.7.1",
        "status": "affected"
      },
      {
        "version": "4.8.1",
        "status": "affected"
      },
      {
        "version": "4.8.1 SR1",
        "status": "affected"
      },
      {
        "version": "5.0.1",
        "status": "affected"
      },
      {
        "version": "5.1.1",
        "status": "affected"
      },
      {
        "version": "5.1.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Cisco",
    "product": "Cisco Session Initiation Protocol (SIP) Software",
    "versions": [
      {
        "version": "9.3(1)",
        "status": "affected"
      },
      {
        "version": "9.1(1)",
        "status": "affected"
      },
      {
        "version": "9.3(1)SR2",
        "status": "affected"
      },
      {
        "version": "9.4(1)",
        "status": "affected"
      },
      {
        "version": "9.2(2)",
        "status": "affected"
      },
      {
        "version": "9.2(1)",
        "status": "affected"
      },
      {
        "version": "9.3(1)SR1",
        "status": "affected"
      },
      {
        "version": "9.4(1)SR2",
        "status": "affected"
      },
      {
        "version": "9.4(1)SR1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uipphone-xss-NcmUykqA

21 Nov 2024 07:41Current

5Medium risk

Vulners AI Score5

CVSS 3.15.4 - 5.5

EPSS0.00077

SSVC

CWE-79