Medium severity4.8NVD Advisory· Published Jun 5, 2024· Updated Jun 17, 2026
CVE-2024-20405
CVE-2024-20405
Description
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
15cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:*range: <11.6\(1\)
- cpe:2.3:a:cisco:finesse:11.6\(1\):-:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:11.6\(1\):es4:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:11.6\(1\):es5:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:11.6\(1\):es6:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:11.6\(1\):es7:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:11.6\(1\):es8:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:12.6\(2\):-:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:12.6\(2\):es01:*:*:*:*:*:*
- cpe:2.3:a:cisco:finesse:12.6\(2\):es02:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: 12.6(2)
- Range: N/A
- Range: N/A
- Range: N/A
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.