PT-2020-3144 · Cisco · Cisco Unity Connection+3
Published
2020-07-01
·
Updated
2020-07-09
·
CVE-2020-3282
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Communications Manager (affected versions not specified)
Cisco Unified Communications Manager Session Management Edition (affected versions not specified)
Cisco Unified Communications Manager IM & Presence Service (affected versions not specified)
Cisco Unity Connection (affected versions not specified)
Description
A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The issue is due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information.
Recommendations
For Cisco Unified Communications Manager, update to a version that includes the fix for this issue.
For Cisco Unified Communications Manager Session Management Edition, update to a version that includes the fix for this issue.
For Cisco Unified Communications Manager IM & Presence Service, update to a version that includes the fix for this issue.
For Cisco Unity Connection, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the web-based management interface until a patch is available.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Unified Communications Manager
Cisco Unified Communications Manager Im & Presence Service
Cisco Unified Communications Manager Session Management Edition
Cisco Unity Connection