CVE-2016-1439: XSS
Published Jun 23, 2016
·Updated
Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Contact Center Enterprise through 10.5(2) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux59650.
Affected Software
69 affected components
cisco Unified Contact Center Enterprise=4.6\(2\)-sr1
cisco Unified Contact Center Enterprise=4.6\(2\)-sr2
cisco Unified Contact Center Enterprise=4.6\(2\)-sr3
cisco Unified Contact Center Enterprise=4.6\(2\)-sr4
cisco Unified Contact Center Enterprise=4.6\(2\)-sr5
cisco Unified Contact Center Enterprise=4.6\(2\)-sr6
cisco Unified Contact Center Enterprise=4.6.2
cisco Unified Contact Center Enterprise=5.0\(0\)
cisco Unified Contact Center Enterprise=5.0\(0\)-sr10
cisco Unified Contact Center Enterprise=5.0\(0\)-sr11
cisco Unified Contact Center Enterprise=5.0\(0\)-sr12
cisco Unified Contact Center Enterprise=5.0\(0\)-sr13
cisco Unified Contact Center Enterprise=5.0\(0\)-sr2
cisco Unified Contact Center Enterprise=5.0\(0\)-sr3
cisco Unified Contact Center Enterprise=5.0\(0\)-sr4
cisco Unified Contact Center Enterprise=5.0\(0\)-sr5
cisco Unified Contact Center Enterprise=5.0\(0\)-sr7
cisco Unified Contact Center Enterprise=5.0\(0\)-sr8
cisco Unified Contact Center Enterprise=5.0\(0\)-sr9
cisco Unified Contact Center Enterprise=6.0\(0\)-sr1
cisco Unified Contact Center Enterprise=6.0\(0\)-sr10
cisco Unified Contact Center Enterprise=6.0\(0\)-sr11
cisco Unified Contact Center Enterprise=6.0\(0\)-sr12
cisco Unified Contact Center Enterprise=6.0\(0\)-sr2
cisco Unified Contact Center Enterprise=6.0\(0\)-sr3
cisco Unified Contact Center Enterprise=6.0\(0\)-sr4
cisco Unified Contact Center Enterprise=6.0\(0\)-sr5
cisco Unified Contact Center Enterprise=6.0\(0\)-sr6
cisco Unified Contact Center Enterprise=6.0\(0\)-sr7
cisco Unified Contact Center Enterprise=6.0\(0\)-sr8
cisco Unified Contact Center Enterprise=6.0\(0\)-sr9
cisco Unified Contact Center Enterprise=7.0\(0\)-sr1
cisco Unified Contact Center Enterprise=7.0\(0\)-sr2
cisco Unified Contact Center Enterprise=7.0\(0\)-sr3
cisco Unified Contact Center Enterprise=7.0\(0\)-sr4
cisco Unified Contact Center Enterprise=7.1\(2\)
cisco Unified Contact Center Enterprise=7.1\(3\)
cisco Unified Contact Center Enterprise=7.1\(4\)
cisco Unified Contact Center Enterprise=7.1\(5\)
cisco Unified Contact Center Enterprise=7.1.0
cisco Unified Contact Center Enterprise=7.2\(1\)
cisco Unified Contact Center Enterprise=7.2\(2\)
cisco Unified Contact Center Enterprise=7.2\(3\)
cisco Unified Contact Center Enterprise=7.2\(4\)
cisco Unified Contact Center Enterprise=7.2\(5\)
cisco Unified Contact Center Enterprise=7.2\(6\)
cisco Unified Contact Center Enterprise=7.2\(7\)
cisco Unified Contact Center Enterprise=7.5\(2\)
cisco Unified Contact Center Enterprise=7.5\(3\)
cisco Unified Contact Center Enterprise=7.5\(4\)
cisco Unified Contact Center Enterprise=7.5\(5\)
cisco Unified Contact Center Enterprise=7.5\(6\)
cisco Unified Contact Center Enterprise=7.5\(7\)
cisco Unified Contact Center Enterprise=7.5\(8\)
cisco Unified Contact Center Enterprise=7.5\(9\)
cisco Unified Contact Center Enterprise=7.5\(10\)
cisco Unified Contact Center Enterprise=8.0\(2\)
cisco Unified Contact Center Enterprise=8.0\(3\)
cisco Unified Contact Center Enterprise=8.5\(1\)
cisco Unified Contact Center Enterprise=8.5\(2\)
cisco Unified Contact Center Enterprise=8.5\(3\)
cisco Unified Contact Center Enterprise=8.5\(4\)
cisco Unified Contact Center Enterprise=9.0\(2\)
cisco Unified Contact Center Enterprise=9.0\(3\)
cisco Unified Contact Center Enterprise=9.0\(4\)
cisco Unified Contact Center Enterprise=10.0\(1\)
cisco Unified Contact Center Enterprise=10.0\(2\)
cisco Unified Contact Center Enterprise=10.5\(1\)
cisco Unified Contact Center Enterprise=10.5\(2\)
Event History
Jun 23, 2016
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1439?
CVE-2016-1439 is considered a medium severity vulnerability due to its potential for exploitation via cross-site scripting.
2
How do I fix CVE-2016-1439?
To address CVE-2016-1439, Cisco recommends upgrading to a version of Unified Contact Center Enterprise that is patched against this vulnerability.
3
What types of attacks can CVE-2016-1439 facilitate?
CVE-2016-1439 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages viewed by users.
4
Which versions of Cisco Unified Contact Center Enterprise are affected by CVE-2016-1439?
CVE-2016-1439 affects various versions of Cisco Unified Contact Center Enterprise, specifically through 10.5(2).
5
Is user interaction necessary for exploiting CVE-2016-1439?
Yes, successful exploitation of CVE-2016-1439 requires user interaction, as the attacker needs to trick the user into clicking the crafted URL.