Cisco Unified Communications Manager Faces Cross-Site Scripting Vulnerability
Original title: Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
Unvalidated input in the web interface of Cisco Unified Communications Manager and SME could allow unauthenticated remote XSS attacks via crafted links.
A cross-site scripting vulnerability exists in the web-based management interface of Cisco Unified Communications Manager and Unified CM Session Management Edition. The interface does not properly validate user-supplied input. An attacker could exploit this by convincing a user to click a crafted link. A successful attack could allow arbitrary script execution in the affected interface context.
- Affects Cisco Unified Communications Manager and Unified CM SME
- Unauthenticated remote exploitation possible
- Requires user interaction to click link
- Could enable arbitrary script code execution
Impact: Cross-site scripting in web management interface
- 1.Upgrade to patched Cisco Unified Communications Manager version
- 2.Restrict interface access
- 3.Audit for suspicious user activity
- Vendors
- Cisco
From the original article
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.