CVE-2022-20948

A vulnerability in the web management interface of Cisco BroadWorks Hosted Thin Receptionist could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

• CWE-79

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-20942A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20943Multiple vulnerabilities in the Server Message Block Version…5.8
• CVE-2022-20944A vulnerability in the software image verification functiona…6.8
• CVE-2022-20945A vulnerability in the 802.11 association frame validation o…6.5
• CVE-2022-20946A vulnerability in the generic routing encapsulation (GRE) t…7.5
• CVE-2022-20947A vulnerability in dynamic access policies (DAP) functionali…7.5
• CVE-2022-20949A vulnerability in the management web server of Cisco Firepo…4.9
• CVE-2022-2095An improper access control check in GitLab CE/EE affecting a…4.3
• CVE-2022-20950A vulnerability in the interaction of SIP and Snort 3 for Ci…5.3
• CVE-2022-20951A vulnerability in the web-based management interface of Cis…6.5
• CVE-2022-20952A vulnerability in the scanning engines of Cisco AsyncOS Sof…5.3
• CVE-2022-20953Multiple vulnerabilities in Cisco TelePresence Collaboration…5.5