A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cisco |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-18082 | A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 07 May 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco enterprise Chat And Email |
|
| CPEs | cpe:2.3:a:cisco:enterprise_chat_and_email:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Cisco
Cisco enterprise Chat And Email |
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2024-08-01T21:59:42.019Z
Reserved: 2023-11-08T15:08:07.653Z
Link: CVE-2024-20367
Vulnrichment
Updated: 2024-08-01T21:59:42.019Z
NVD
Status : Analyzed
Published: 2024-04-03T17:15:49.907
Modified: 2025-05-07T16:17:08.593
Link: CVE-2024-20367
Redhat
No data.
OpenCVE Enrichment
No data.