PT-2014-4495 · Cisco · Cisco Unity Connection

Publicado 2014-04-02 · Atualizado 2015-09-16 · CVE-2014-2125

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection versions 8.6(2a)SU3 and earlier

Description A cross-site scripting (XSS) issue exists in the Web Inbox of Cisco Unity Connection, allowing remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Recommendations For versions 8.6(2a)SU3 and earlier, update to a version later than 8.6(2a)SU3 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-2125

Produtos afetados

Cisco Unity Connection

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125 · Aviso do Fabricante
• http://securitytracker.com/id/1029988 · Nota
• http://tools.cisco.com/security/center/viewAlert.x?alertId=33603 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2125 · Nota de Segurança