CVE-2017-3802: XSS

Published Jan 26, 2017

Updated

A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc20679. Known Affected Releases: 12.0(0.99000.9). Known Fixed Releases: 12.0(0.98000.176) 12.0(0.98000.414) 12.0(0.98000.531) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.8).

Affected Software

1 affected component

Cisco Unified Communications Manager=12.0\(0.99000.9\)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.176)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.414)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.531)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.536)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98000.6)
Upgrade
Upgrade Cisco Unified Communications Manager to a version that resolves this vulnerability.
Fixed in 12.0(0.98500.8)

Event History

Jan 26, 2017

CVE Published

via MITRE·07:45 AM

Data Sourced

via MITRE·07:45 AM

DescriptionWeakness

Data Sourced

via NVD·07:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3802?

CVE-2017-3802 is classified as a high severity vulnerability due to its potential to allow unauthenticated remote attackers to exploit it.

How do I fix CVE-2017-3802?

To fix CVE-2017-3802, you should upgrade Cisco Unified Communications Manager to a fixed release version as specified by Cisco.

What type of attack does CVE-2017-3802 allow?

CVE-2017-3802 allows for cross-site scripting (XSS) attacks through the web interface of the affected Cisco Unified Communications Manager.

What versions are affected by CVE-2017-3802?

CVE-2017-3802 affects Cisco Unified Communications Manager version 12.0(0.99000.9).

Is authentication required to exploit CVE-2017-3802?

No, an attacker does not need to be authenticated to exploit CVE-2017-3802.