PT-2009-4501 · Cisco · Cisco Unified Contact Center Express (Ccx) Server+1

Published 2009-07-16 · Updated 2017-08-17 · CVE-2009-2048

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Express (CCX) server versions prior to 7.0(1) SR2

Description A cross-site scripting (XSS) issue exists in the Administration interface of Cisco Customer Response Solutions (CRS) in Cisco Unified Contact Center Express (CCX) server. This allows remote authenticated users to inject arbitrary web script or HTML into the CCX database.

Recommendations For versions prior to 7.0(1) SR2, update to version 7.0(1) SR2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Administration interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-2048

Affected Products

Cisco Customer Response Solutions

Cisco Unified Contact Center Express (Ccx) Server

References · 8

• http://cisco.com/en/US/products/products_security_advisory09186a0080ae04b2.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2048 · Security Note
• http://securityfocus.com/bid/35705 · Note
• http://secunia.com/advisories/35861 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51730 · Note
• http://osvdb.org/55937 · Note
• http://securitytracker.com/id?1022569 · Note
• http://vupen.com/english/advisories/2009/1913 · Note