PT-2017-1541 · Cisco · Cisco Unified Communications Manager

Publicado 2017-03-17 · Atualizado 2019-04-22 · CVE-2017-3872

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 10.5(2.14076.1) Cisco Unified Communications Manager versions prior to 12.0(0.98000.219)

Description A cross-site scripting (XSS) filter bypass issue exists in the web-based management interface, allowing an unauthenticated, remote attacker to conduct XSS attacks against a user of an affected device. The vulnerability is due to insufficient protection of the web page structure, which can be exploited by a remote attacker to bypass the XSS filter and perform cross-site scripting attacks.

Recommendations For Cisco Unified Communications Manager version 10.5(2.14076.1), update to version 12.0(0.98000.219) or later to resolve the issue. For Cisco Unified Communications Manager versions prior to 12.0(0.98000.219), update to version 12.0(0.98000.219) or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2017-00686

CVE-2017-3872

Produtos afetados

Cisco Unified Communications Manager

Referências · 6

• http://securityfocus.com/bid/96916 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ucm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-3872 · Aviso do Fabricante
• http://securitytracker.com/id/1038036 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3872 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-00686 · Nota de Segurança