PT-2017-1795 · Cisco · Cisco Unified Communications Manager

Published 2017-04-07 · Updated 2017-07-12 · CVE-2017-3888

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to 12.0(0.98000.750) Cisco Unified Communications Manager versions prior to 12.0(0.98000.708) Cisco Unified Communications Manager versions prior to 12.0(0.98000.707) Cisco Unified Communications Manager versions prior to 12.0(0.98000.704) Cisco Unified Communications Manager versions prior to 12.0(0.98000.554) Cisco Unified Communications Manager versions prior to 12.0(0.98000.546) Cisco Unified Communications Manager versions prior to 12.0(0.98000.543) Cisco Unified Communications Manager versions prior to 12.0(0.98000.248) Cisco Unified Communications Manager versions prior to 12.0(0.98000.244) Cisco Unified Communications Manager versions prior to 12.0(0.98000.242)

However, to consolidate the ranges of affected versions into the most concise form, the above list can be simplified to: Cisco Unified Communications Manager version 12.0(0.98000.452)

Description A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This issue arises due to the lack of protection measures for the web page structure, potentially allowing a remote attacker to obtain information about the operating system using cross-site scripting.

Recommendations For Cisco Unified Communications Manager version 12.0(0.98000.452), update to version 12.0(0.98000.750) or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2017-00951

CVE-2017-3888

Affected Products

Cisco Unified Communications Manager

References · 6

• https://bdu.fstec.ru/vul/2017-00951 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ucm1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3888 · Security Note
• http://securityfocus.com/bid/97431 · Note
• http://securitytracker.com/id/1038193 · Note