PT-2007-5475 · Cisco · Cisco Unified Meetingplace Web Conferencing

Published 2007-08-09 · Updated 2018-10-15 · CVE-2007-4284

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Web Conferencing versions 5.3.235.0 and earlier

Description The issue allows remote attackers to inject arbitrary HTML and web script via the Success Template (STPL) and Failure Template (FTPL) parameters, which are not properly handled in an error message. This can lead to cross-site scripting (XSS) attacks.

Recommendations For versions 5.3.235.0 and earlier, consider disabling the Success Template (STPL) and Failure Template (FTPL) parameters until a patch is available to properly handle these parameters in error messages. Restrict access to error messages that may contain user-supplied input to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-4284

Affected Products

Cisco Unified Meetingplace Web Conferencing

References · 11

• http://cisco.com/en/US/products/products_security_response09186a008089969e.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4284 · Security Note
• http://securityfocus.com/archive/1/475840/100/0/threaded · Note
• http://securityreason.com/securityalert/2990 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35871 · Note
• http://securitytracker.com/id?1018537 · Note
• http://securityfocus.com/bid/25237 · Note
• http://secunia.com/advisories/26376 · Note
• http://vupen.com/english/advisories/2007/2815 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html · Note
• http://securityfocus.com/archive/1/475845/100/0/threaded · Note