CVE-2017-12212: XSS
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12212?
CVE-2017-12212 has a medium severity level due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2017-12212?
To fix CVE-2017-12212, update the Cisco Unity Connection to the latest version that addresses this vulnerability.
Who is affected by CVE-2017-12212?
Users of Cisco Unity Connection version 10.5(2) are affected by CVE-2017-12212.
What type of attack can be conducted via CVE-2017-12212?
CVE-2017-12212 allows an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack.
What is the cause of CVE-2017-12212?
CVE-2017-12212 is caused by insufficient input validation in the web framework of Cisco Unity Connection.