CVE-2022-20969
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in multiple management dashboard pages of Cisco Umbrella allows an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard. This issue is due to unsanitized user input.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary script code in the context of the interface or access sensitive browser-based information, potentially leading to serious security breaches.
Recommendation
It is recommended to update Cisco Umbrella software to the latest version to mitigate this vulnerability and implement additional security measures such as input validation.
Original NVD description (English source)
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard. This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to the web application and persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.