PT-2019-1547 · Cisco · Cisco Enterprise Chat/Email

Published 2019-03-06 · Updated 2019-10-09 · CVE-2019-1702

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Enterprise Chat and Email version 11.6(1)

Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. This could be achieved by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. The attacker must persuade the user to click the crafted link or open the chat window containing the malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Recommendations For version 11.6(1), consider disabling the web-based management interface until a patch is available to prevent exploitation. Restrict access to the interface to minimize the risk of attack. Avoid clicking on crafted links or opening chat windows from untrusted sources to reduce the risk of XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-01077

CVE-2019-1702

Affected Products

Cisco Enterprise Chat/Email

References · 5

• https://bdu.fstec.ru/vul/2019-01077 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-chatmail-xss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1702 · Security Note
• http://securityfocus.com/bid/107314 · Note