cisco-sa-20170315-ucm1

A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input by the Cisco Unified CM User Options portal of the affected software. An attacker could exploit this vulnerability by persuading an authenticated user of the portal to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary code in the context of the portal. There are no workarounds that address this vulnerability.