{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-20310", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.253Z", "datePublished": "2025-07-02T16:05:43.738Z", "dateUpdated": "2025-07-02T17:32:09.591Z"}, "containers": {"cna": {"title": "Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc", "name": "cisco-sa-ece-xss-CbtKtEYc"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ece-xss-CbtKtEYc", "discovery": "INTERNAL", "defects": ["CSCwo21879"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "cwe", "cweId": "CWE-79"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"version": "11.6(1)_ES3", "status": "affected"}, {"version": "11.6(1)_ES4", "status": "affected"}, {"version": "12.0(1)_ES6", "status": "affected"}, {"version": "11.6(1)_ES8", "status": "affected"}, {"version": "12.0(1)_ES5a", "status": "affected"}, {"version": "11.6(1)_ES9", "status": "affected"}, {"version": "12.0(1)_ES6_ET1", "status": "affected"}, {"version": "11.6(1)_ES6", "status": "affected"}, {"version": "11.6(1)_ES5", "status": "affected"}, {"version": "12.5(1)_ET1", "status": "affected"}, {"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)_ES3_ET1", "status": "affected"}, {"version": "12.0(1)_ES3", "status": "affected"}, {"version": "11.6(1)_ES11", "status": "affected"}, {"version": "12.0(1)_ES4", "status": "affected"}, {"version": "12.0(1)_ES5", "status": "affected"}, {"version": "11.6(1)_ES2", "status": "affected"}, {"version": "11.6(1)_ES9a", "status": "affected"}, {"version": "11.6(1)_ES10", "status": "affected"}, {"version": "12.0(1)_ES1", "status": "affected"}, {"version": "12.0(1)", "status": "affected"}, {"version": "12.5(1)_ES3", "status": "affected"}, {"version": "12.6(1)", "status": "affected"}, {"version": "11.5(1)", "status": "affected"}, {"version": "12.0(1)_ES2", "status": "affected"}, {"version": "11.6(1)_ES7", "status": "affected"}, {"version": "12.5(1)_ES2", "status": "affected"}, {"version": "12.6(1)_ET1", "status": "affected"}, {"version": "11.6(1)", "status": "affected"}, {"version": "12.5(1)_ES1", "status": "affected"}, {"version": "11.5(1)_ES1_ET1", "status": "affected"}, {"version": "11.6(1)_ES6_ET1", "status": "affected"}, {"version": "11.6(1)_ES1", "status": "affected"}, {"version": "11.6(1)_ES8_ET1", "status": "affected"}, {"version": "11.5(1)_ES1", "status": "affected"}, {"version": "12.6(1)_ET2", "status": "affected"}, {"version": "12.5(1)_ES3_ET2", "status": "affected"}, {"version": "12.0(1)_ES6_ET2", "status": "affected"}, {"version": "12.6(1)_ES1", "status": "affected"}, {"version": "12.5(1)_ES4", "status": "affected"}, {"version": "11.6(1)_ES12", "status": "affected"}, {"version": "12.6(1)_ET3", "status": "affected"}, {"version": "12.5(1)_ES4_ET1", "status": "affected"}, {"version": "12.0(1)_ES6_ET3", "status": "affected"}, {"version": "12.6(1)_ES1_ET1", "status": "affected"}, {"version": "12.6(1)_ES2", "status": "affected"}, {"version": "12.6_ES2_ET1", "status": "affected"}, {"version": "12.5(1)_ES5", "status": "affected"}, {"version": "12.6_ES2_ET2", "status": "affected"}, {"version": "12.0(1)_ES7", "status": "affected"}, {"version": "12.6_ES2_ET3", "status": "affected"}, {"version": "12.0(1)_ES7_ET1", "status": "affected"}, {"version": "12.5(1)_ES5_ET1", "status": "affected"}, {"version": "12.6_ES2_ET4", "status": "affected"}, {"version": "12.6(1)_ES3", "status": "affected"}, {"version": "11.6(1)_ES12_ET1", "status": "affected"}, {"version": "12.6_ES3_ET1", "status": "affected"}, {"version": "12.5(1)_ES6", "status": "affected"}, {"version": "12.6_ES3_ET2", "status": "affected"}, {"version": "12.6(1)_ES4", "status": "affected"}, {"version": "12.5(1)_ES7", "status": "affected"}, {"version": "12.6(1)_ES4_ET1", "status": "affected"}, {"version": "12.6(1)_ES5", "status": "affected"}, {"version": "12.6(1)_ES5_ET1", "status": "affected"}, {"version": "12.6(1)_ES5_ET2", "status": "affected"}, {"version": "12.6(1)_ES6", "status": "affected"}, {"version": "12.6(1)_ES6_ET1", "status": "affected"}, {"version": "12.5(1)_ES8", "status": "affected"}, {"version": "12.6(1)_ES6_ET2", "status": "affected"}, {"version": "12.6(1)_ES7", "status": "affected"}, {"version": "12.6(1)_ES8", "status": "affected"}, {"version": "12.6(1)_ES4_ET2", "status": "affected"}, {"version": "12.6(1)_ES3_ET3", "status": "affected"}, {"version": "12.6(1)_ES2_ET5", "status": "affected"}, {"version": "12.6(1)_ES1_ET2", "status": "affected"}, {"version": "12.6(1)_ES8_ET1", "status": "affected"}, {"version": "12.6(1)_ES7_ET1", "status": "affected"}, {"version": "12.6(1)_ES6_ET3", "status": "affected"}, {"version": "12.6(1)_ES5_ET3", "status": "affected"}, {"version": "12.5(1)_ES8_ET1", "status": "affected"}, {"version": "12.5(1)_ES3_ET3", "status": "affected"}, {"version": "12.5(1)_ES5_ET2", "status": "affected"}, {"version": "12.5(1)_ES6_ET1", "status": "affected"}, {"version": "12.5(1)_ES4_ET2", "status": "affected"}, {"version": "12.5(1)_ES7_ET1", "status": "affected"}, {"version": "12.6(1)_ES8_ET2", "status": "affected"}, {"version": "12.6(1)_ES9", "status": "affected"}, {"version": "12.6(1)_ES9_ET1", "status": "affected"}, {"version": "12.5(1)_ES9", "status": "affected"}, {"version": "12.6(1)_ES9_ET2", "status": "affected"}, {"version": "12.6(1)_ES9_ET3", "status": "affected"}, {"version": "12.6(1)_ES10", "status": "affected"}, {"version": "12.6(1)_ES10_ET1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-07-02T16:39:49.265Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-02T17:28:39.761037Z", "id": "CVE-2025-20310", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T17:32:09.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-02T17:28:39.761037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T17:29:14.132Z"}}], "cna": {"title": "Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability", "source": {"defects": ["CSCwo21879"], "advisory": "cisco-sa-ece-xss-CbtKtEYc", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Enterprise Chat and Email", "versions": [{"status": "affected", "version": "11.6(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES4"}, {"status": "affected", "version": "12.0(1)_ES6"}, {"status": "affected", "version": "11.6(1)_ES8"}, {"status": "affected", "version": "12.0(1)_ES5a"}, {"status": "affected", "version": "11.6(1)_ES9"}, {"status": "affected", "version": "12.0(1)_ES6_ET1"}, {"status": "affected", "version": "11.6(1)_ES6"}, {"status": "affected", "version": "11.6(1)_ES5"}, {"status": "affected", "version": "12.5(1)_ET1"}, {"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)_ES3_ET1"}, {"status": "affected", "version": "12.0(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES11"}, {"status": "affected", "version": "12.0(1)_ES4"}, {"status": "affected", "version": "12.0(1)_ES5"}, {"status": "affected", "version": "11.6(1)_ES2"}, {"status": "affected", "version": "11.6(1)_ES9a"}, {"status": "affected", "version": "11.6(1)_ES10"}, {"status": "affected", "version": "12.0(1)_ES1"}, {"status": "affected", "version": "12.0(1)"}, {"status": "affected", "version": "12.5(1)_ES3"}, {"status": "affected", "version": "12.6(1)"}, {"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "12.0(1)_ES2"}, {"status": "affected", "version": "11.6(1)_ES7"}, {"status": "affected", "version": "12.5(1)_ES2"}, {"status": "affected", "version": "12.6(1)_ET1"}, {"status": "affected", "version": "11.6(1)"}, {"status": "affected", "version": "12.5(1)_ES1"}, {"status": "affected", "version": "11.5(1)_ES1_ET1"}, {"status": "affected", "version": "11.6(1)_ES6_ET1"}, {"status": "affected", "version": "11.6(1)_ES1"}, {"status": "affected", "version": "11.6(1)_ES8_ET1"}, {"status": "affected", "version": "11.5(1)_ES1"}, {"status": "affected", "version": "12.6(1)_ET2"}, {"status": "affected", "version": "12.5(1)_ES3_ET2"}, {"status": "affected", "version": "12.0(1)_ES6_ET2"}, {"status": "affected", "version": "12.6(1)_ES1"}, {"status": "affected", "version": "12.5(1)_ES4"}, {"status": "affected", "version": "11.6(1)_ES12"}, {"status": "affected", "version": "12.6(1)_ET3"}, {"status": "affected", "version": "12.5(1)_ES4_ET1"}, {"status": "affected", "version": "12.0(1)_ES6_ET3"}, {"status": "affected", "version": "12.6(1)_ES1_ET1"}, {"status": "affected", "version": "12.6(1)_ES2"}, {"status": "affected", "version": "12.6_ES2_ET1"}, {"status": "affected", "version": "12.5(1)_ES5"}, {"status": "affected", "version": "12.6_ES2_ET2"}, {"status": "affected", "version": "12.0(1)_ES7"}, {"status": "affected", "version": "12.6_ES2_ET3"}, {"status": "affected", "version": "12.0(1)_ES7_ET1"}, {"status": "affected", "version": "12.5(1)_ES5_ET1"}, {"status": "affected", "version": "12.6_ES2_ET4"}, {"status": "affected", "version": "12.6(1)_ES3"}, {"status": "affected", "version": "11.6(1)_ES12_ET1"}, {"status": "affected", "version": "12.6_ES3_ET1"}, {"status": "affected", "version": "12.5(1)_ES6"}, {"status": "affected", "version": "12.6_ES3_ET2"}, {"status": "affected", "version": "12.6(1)_ES4"}, {"status": "affected", "version": "12.5(1)_ES7"}, {"status": "affected", "version": "12.6(1)_ES4_ET1"}, {"status": "affected", "version": "12.6(1)_ES5"}, {"status": "affected", "version": "12.6(1)_ES5_ET1"}, {"status": "affected", "version": "12.6(1)_ES5_ET2"}, {"status": "affected", "version": "12.6(1)_ES6"}, {"status": "affected", "version": "12.6(1)_ES6_ET1"}, {"status": "affected", "version": "12.5(1)_ES8"}, {"status": "affected", "version": "12.6(1)_ES6_ET2"}, {"status": "affected", "version": "12.6(1)_ES7"}, {"status": "affected", "version": "12.6(1)_ES8"}, {"status": "affected", "version": "12.6(1)_ES4_ET2"}, {"status": "affected", "version": "12.6(1)_ES3_ET3"}, {"status": "affected", "version": "12.6(1)_ES2_ET5"}, {"status": "affected", "version": "12.6(1)_ES1_ET2"}, {"status": "affected", "version": "12.6(1)_ES8_ET1"}, {"status": "affected", "version": "12.6(1)_ES7_ET1"}, {"status": "affected", "version": "12.6(1)_ES6_ET3"}, {"status": "affected", "version": "12.6(1)_ES5_ET3"}, {"status": "affected", "version": "12.5(1)_ES8_ET1"}, {"status": "affected", "version": "12.5(1)_ES3_ET3"}, {"status": "affected", "version": "12.5(1)_ES5_ET2"}, {"status": "affected", "version": "12.5(1)_ES6_ET1"}, {"status": "affected", "version": "12.5(1)_ES4_ET2"}, {"status": "affected", "version": "12.5(1)_ES7_ET1"}, {"status": "affected", "version": "12.6(1)_ES8_ET2"}, {"status": "affected", "version": "12.6(1)_ES9"}, {"status": "affected", "version": "12.6(1)_ES9_ET1"}, {"status": "affected", "version": "12.5(1)_ES9"}, {"status": "affected", "version": "12.6(1)_ES9_ET2"}, {"status": "affected", "version": "12.6(1)_ES9_ET3"}, {"status": "affected", "version": "12.6(1)_ES10"}, {"status": "affected", "version": "12.6(1)_ES10_ET1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc", "name": "cisco-sa-ece-xss-CbtKtEYc"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-07-02T16:39:49.265Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20310", "state": "PUBLISHED", "dateUpdated": "2025-07-02T17:32:09.591Z", "dateReserved": "2024-10-10T19:15:13.253Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-07-02T16:05:43.738Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz web de Cisco Enterprise Chat and Email (ECE) podr\u00eda permitir que un atacante remoto no autenticado realice un ataque de Cross-Site Scripting (XSS) almacenado contra un usuario de la interfaz. Esta vulnerabilidad existe porque la interfaz web no valida correctamente la informaci\u00f3n proporcionada por el usuario. Un atacante podr\u00eda explotar esta vulnerabilidad persuadiendo a un usuario de la interfaz para que haga clic en un enlace manipulado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar c\u00f3digo de script arbitrario en el contexto de la interfaz afectada o acceder a informaci\u00f3n confidencial del navegador. Para explotar esta vulnerabilidad, un atacante necesitar\u00eda valid agent credentials. "}], "id": "CVE-2025-20310", "lastModified": "2025-07-03T15:13:53.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2025-07-02T16:15:28.667", "references": [{"source": "[email protected]", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-xss-CbtKtEYc"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}

{}