CVE-2020-3345

MEDIUM

Cisco Webex Meetings < 40.6.0 and Webex Meetings Server < 4.0 - Cross-Site Scripting

Title source: llm
STIX 2.1

Description

A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web page in the context of a browser. The vulnerability is due to improper checks on parameter values within affected pages. An attacker could exploit this vulnerability by persuading a user to follow a crafted link that is designed to pass HTML code into an affected parameter. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious web sites, or the attacker could leverage this vulnerability to conduct further client-side attacks.

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0053
EPSS Percentile 67.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (3)
cisco/webex_meetings < 40.6.0
cisco/webex_meetings_server 4.0 (3 CPE variants)
cisco/webex_meetings_server < 4.0
Published Jul 16, 2020
Tracked Since Feb 18, 2026