PT-2007-5475 · Cisco · Cisco Unified Meetingplace Web Conferencing

Publicado 2007-08-09 · Atualizado 2018-10-15 · CVE-2007-4284

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Web Conferencing versions 5.3.235.0 and earlier

Description The issue allows remote attackers to inject arbitrary HTML and web script via the Success Template (STPL) and Failure Template (FTPL) parameters, which are not properly handled in an error message. This can lead to cross-site scripting (XSS) attacks.

Recommendations For versions 5.3.235.0 and earlier, consider disabling the Success Template (STPL) and Failure Template (FTPL) parameters until a patch is available to properly handle these parameters in error messages. Restrict access to error messages that may contain user-supplied input to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4284

Produtos afetados

Cisco Unified Meetingplace Web Conferencing

Referências · 11

• http://cisco.com/en/US/products/products_security_response09186a008089969e.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/475840/100/0/threaded · Nota
• http://securityreason.com/securityalert/2990 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35871 · Nota
• http://securitytracker.com/id?1018537 · Nota
• http://securityfocus.com/bid/25237 · Nota
• http://secunia.com/advisories/26376 · Nota
• http://vupen.com/english/advisories/2007/2815 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4284 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html · Nota
• http://securityfocus.com/archive/1/475845/100/0/threaded · Nota