CVE-2020-27126— Cisco Webex Meetings API Cross-Site Scripting Vulnerability
Quick assessment
Affected
Cisco Cisco Webex Meetings
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Webex Meetings是美国思科（Cisco）公司的一套视频会议解决方案。 Cisco Webex Meetings 存在跨站脚本漏洞，攻击者可利用该漏洞进行跨站点脚本攻击。成功利用该漏洞可以允许攻击者利用该漏洞进行跨站点脚本攻击，并可能获得对敏感的基于浏览器的infor的访问权。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1566 · Phishing T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-27126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Webex Meetings API Cross-Site Scripting Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) within Cisco Webex Meetings. An attacker could exploit this vulnerability by convincing a targeted user to follow a link designed to submit malicious input to the API used by Cisco Webex Meetings. A successful exploit could allow the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information from the system of a targeted user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Webex Meetings 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Webex Meetings是美国思科（Cisco）公司的一套视频会议解决方案。 Cisco Webex Meetings 存在跨站脚本漏洞，攻击者可利用该漏洞进行跨站点脚本攻击。成功利用该漏洞可以允许攻击者利用该漏洞进行跨站点脚本攻击，并可能获得对敏感的基于浏览器的infor的访问权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Webex Meetings | n/a | - |
|
II. Public POCs for CVE-2020-27126
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-27126
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-27126 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-xss-MX56prER vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2020-11-18 · 19 CVEs total
| CVE-2020-3470 | 9.8 CRITICAL | Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities |
| CVE-2020-3586 | 9.4 CRITICAL | Cisco DNA Spaces Connector Command Injection Vulnerability |
| CVE-2020-3471 | 6.5 MEDIUM | Cisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposu |
| CVE-2020-3419 | 6.5 MEDIUM | Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join Vulnerability |
| CVE-2020-26068 | 5.5 MEDIUM | Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerabi |
| CVE-2020-3441 | 5.3 MEDIUM | Cisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure Vulnerability |
| CVE-2020-3367 | Cisco Secure Web Appliance Privilege Escalation Vulnerability | |
| CVE-2020-3531 | Cisco IoT Field Network Director Unauthenticated REST API Vulnerability | |
| CVE-2020-3482 | Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability | |
| CVE-2020-3392 | Cisco IoT Field Network Director Missing API Authentication Vulnerability | |
| CVE-2020-26081 | Cisco IoT Field Network Director Cross-Site Scripting Vulnerabilities | |
| CVE-2020-26080 | Cisco IoT Field Network Director Improper Domain Access Control Vulnerability | |
| CVE-2020-26079 | Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability | |
| CVE-2020-26078 | Cisco IoT Field Network Director File Overwrite Vulnerability | |
| CVE-2020-26077 | Cisco IoT Field Network Director Improper Access Control Vulnerability | |
| CVE-2020-26076 | Cisco IoT Field Network Director Information Disclosure Vulnerability | |
| CVE-2020-26075 | Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability | |
| CVE-2020-26072 | Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability |
IV. Related Vulnerabilities
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-80
-
CVE-2026-103585
attacker-controlled javascript license URL via XSS -
CVE-2026-103584
attacker-controlled javascript license URL via XSS -
CVE-2026-103439
Various rawParams() and escaped() updates to prevent XSS in -
CVE-2026-103438
Various rawParams() and escaped() updates to prevent XSS in -
CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
V. Comments for CVE-2020-27126
No comments yet