6.5

CVE-2021-1245: cisco cisco unified customer voice portal (cvp) Cross-site Scripting

CVSS: 6.5v3.1MediumModified
Published 13-01-2021Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2021-1245 is a medium (CVSS 6.5) Cross-site Scripting vulnerability in cisco cisco unified customer voice portal (cvp). EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.38%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-01-2021
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

1.38%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

+0.02 pp

From 1.36% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco2 products
  • cisco unified customer voice portal (cvp)12.6(2)_ES4 | 12.6(2)_ET5 | 12.6(2)_ET7 | 12.6(2)_ET8 | 12.6(2)_ES9 | 12.6(2)_ES10 | 12.6(2)_ES11 | 12.6(2)_ET12 | 12.6(2)_ET13 | 12.6(2)_ES14 | 12.6(2)_ES15 | 12.6(2)_ET16 | 12.6(2)_ET17
  • finesse< 12.0\(1\) | 12.0\(1\) | 12.0\(1\):es1 | 12.0\(1\):es2 | 12.0\(1\):es3 | 12.0\(1\):es4 | 12.0\(1\):es5 | 12.5\(1\) | 12.5\(1\):es1 | 12.5\(1\):es2 | 12.5\(1\):es3 | 12.5\(1\):es4

1 vendor · 2 products

References

2 links