CVE-2007-4633: XSS

Published Aug 31, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to inject arbitrary web script or HTML via the lang variable to the (1) user or (2) admin logon page, aka CSCsi10728.

Affected Software

19 affected components

Cisco Call Manager=4.2\(2\)

Cisco Unified Communications Manager=4.2.3sr2

Cisco Call Manager=4.3\(1\)sr1

Cisco Call Manager=3.3\(5\)sr2

Cisco Call Manager=4.3\(1\)

Cisco Call Manager=4.1\(3\)sr1

Cisco Call Manager=4.1

Cisco Call Manager=3.3\(5\)sr2a

Cisco Call Manager=4.1\(3\)sr2

Cisco Call Manager=4.2

Cisco Call Manager=4.2\(1\)

Cisco Call Manager=4.3

Cisco Call Manager=4.1\(3\)sr3

Cisco Call Manager=4.2\(3\)sr1

Cisco Call Manager=4.2\(3\)

Cisco Call Manager=4.2\(3\)sr2

Cisco Call Manager=4.1\(3\)sr4

Cisco Call Manager=3.3\(5\)sr1

Cisco Unified Communications Manager=4.2.3sr2b

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml

Event History

Aug 31, 2007

CVE Published

11:17 PM

Sep 1, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4633?

CVE-2007-4633 has a medium severity rating due to its cross-site scripting vulnerabilities.

How do I fix CVE-2007-4633?

To fix CVE-2007-4633, upgrade to a patched version of Cisco CallManager or Unified Communications Manager that addresses the vulnerabilities.

What systems are affected by CVE-2007-4633?

CVE-2007-4633 affects multiple versions of Cisco CallManager and Unified Communications Manager prior to specified patches.

Can CVE-2007-4633 be exploited remotely?

Yes, CVE-2007-4633 can be exploited remotely, allowing attackers to inject arbitrary web scripts.

What are the potential impacts of CVE-2007-4633?

The potential impacts of CVE-2007-4633 include unauthorized access and manipulation of user sessions through cross-site scripting.