CVE-2026-20170

{
  "id": "CVE-2026-20170",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T17:17:03.297",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed.\r\n\r This vulnerability existed because HTML and script content was not properly handled. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to steal sensitive information from the browser, including authentication and session information."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la funcionalidad de Desktop Agent de Cisco Webex Contact Center podría haber permitido a un atacante remoto no autenticado realizar ataques de cross-site scripting. Cisco ha abordado esta vulnerabilidad en el servicio de Cisco Webex Contact Center, y no se requiere ninguna acción por parte del cliente.\nEsta vulnerabilidad existía porque el contenido HTML y de script no se manejaba correctamente. Antes de que se abordara esta vulnerabilidad, un atacante podría haber explotado esta vulnerabilidad persuadiendo a un usuario para que siguiera un enlace malicioso. Un exploit exitoso podría haber permitido al atacante robar información sensible del navegador, incluyendo información de autenticación y de sesión."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Cisco",
          "product": "Cisco Webex Contact Center",
          "versions": [
            {
              "version": "N/A",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T16:42:50.336172Z",
          "id": "CVE-2026-20170",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:webex_contact_center:-:*:*:*:cloud-based:*:*:*",
              "matchCriteriaId": "C152A05A-CA52-4D69-9531-B577E25B4192"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webexcc-xss-WEX5nUnA",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}