PT-2020-1653 · Cisco · Cisco Jabber Guest
Published
2020-01-22
·
Updated
2020-01-28
·
CVE-2020-3136
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Jabber Guest versions 11.1(2) and earlier
Description
A vulnerability in the web-based management interface of Cisco Jabber Guest could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
Recommendations
For Cisco Jabber Guest versions 11.1(2) and earlier, update to a version later than 11.1(2) to resolve the issue.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Avoid clicking on suspicious links from untrusted sources to reduce the risk of attack.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Jabber Guest