Vulnslist

find the latest Cisco vulnerabilities

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

cisco-sa-20170118-cucm · Medium · Published · Updated

A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. The vulnerability is due to a failure to properly call XSS filter subsystems when a URL contains a certain parameter. An attacker who can persuade an authenticated user of an affected device to follow an attacker-provided link or visit an attacker-controlled website could exploit this vulnerability to execute arbitrary code in the context of the affected site in the user's browser. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-cucm

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

CVEsCVE-2017-3798
Cisco Bug IDsCSCvb97237
CVSS ScoreBase 6.1
Base 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
Product Names From Source
Cisco Unified Communications Manager

CSAF Product Statuses

Product Status Source CVE Rows
Cisco Unified Communications Manager known_affected cisco_csaf CVE-2017-3798 1

Related Products

Product CVE Evidence
Cisco Unified Communications Manager CVE-2017-3798 Cisco OpenVuln