PT-2007-5791 · Cisco · Cisco Callmanager+1

Published 2007-08-31 · Updated 2017-07-29 · CVE-2007-4633

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco CallManager and Unified Communications Manager (CUCM) versions prior to 3.3(5)sr2b Cisco CallManager and Unified Communications Manager (CUCM) versions 4.1 prior to 4.1(3)sr5 Cisco CallManager and Unified Communications Manager (CUCM) versions 4.2 prior to 4.2(3)sr2 Cisco CallManager and Unified Communications Manager (CUCM) versions 4.3 prior to 4.3(1)sr1

Description The issue allows remote attackers to inject arbitrary web script or HTML via the lang variable to the (1) user or (2) admin logon page.

Recommendations For versions prior to 3.3(5)sr2b, update to version 3.3(5)sr2b or later. For versions 4.1 prior to 4.1(3)sr5, update to version 4.1(3)sr5 or later. For versions 4.2 prior to 4.2(3)sr2, update to version 4.2(3)sr2 or later. For versions 4.3 prior to 4.3(1)sr1, update to version 4.3(1)sr1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-4633

Affected Products

Cisco Callmanager

Cisco Unified Communications Manager

References · 7

• http://secunia.com/advisories/26641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4633 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36325 · Note
• http://securitytracker.com/id?1018624 · Note
• http://vupen.com/english/advisories/2007/3010 · Note
• http://securityfocus.com/bid/25480 · Note