PT-2019-1501 · Cisco · Cisco Unity Connection

Published 2019-02-20 · Updated 2023-03-23 · CVE-2019-1685

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection version 12.5

Description A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The issue is due to insufficient validation of user-supplied input by the interface. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.

Recommendations For version 12.5, consider disabling the SAML SSO interface until a patch is available to prevent exploitation. Restrict access to the interface to minimize the risk of XSS attacks. Avoid using the interface with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-00943

CVE-2019-1685

Affected Products

Cisco Unity Connection

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-cuc-rxss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1685 · Security Note
• https://bdu.fstec.ru/vul/2019-00943 · Security Note
• http://securityfocus.com/bid/107102 · Note