CVE-2014-2125: XSS
Published Apr 2, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.
Affected Software
8 affected components
Cisco Unity Connection<=8.6
Cisco Unity Connection=8.6
Cisco Unity Connection=8.6-\(1\)
Cisco Unity Connection=8.6-\(2\)
Cisco Unity Connection=8.6-\(2a\)su1
Cisco Unity Connection=8.6-\(2a\)su2
Cisco Unity Connection=8.6\(1a\)
Cisco Unity Connection=8.6\(2a\)
Event History
Apr 2, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·03:58 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2125?
CVE-2014-2125 has a medium severity rating due to its potential for cross-site scripting attacks that can affect user sessions.
2
How do I fix CVE-2014-2125?
To resolve CVE-2014-2125, upgrade your Cisco Unity Connection software to a version later than 8.6(2a)SU3.
3
What software is affected by CVE-2014-2125?
CVE-2014-2125 affects Cisco Unity Connection versions 8.6(2a)SU3 and earlier.
4
What type of vulnerability is CVE-2014-2125?
CVE-2014-2125 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject web scripts or HTML.
5
Can CVE-2014-2125 be exploited remotely?
Yes, CVE-2014-2125 can be exploited remotely by attackers to inject harmful scripts.