CVE-2018-0444: Cisco Packaged Contact Center Enterprise Cross-Site Scripting Vulnerability

Published Oct 5, 2018

Updated

A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Affected Software

1 affected component

Cisco Packaged Contact Center Enterprise=11.6\(1\)

Event History

Oct 5, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this Cisco Packaged Contact Center Enterprise vulnerability?

The vulnerability ID for this Cisco Packaged Contact Center Enterprise vulnerability is CVE-2018-0444.

What is the severity level of CVE-2018-0444?

The severity level of CVE-2018-0444 is medium.

What is the CWE ID for this vulnerability?

The CWE ID for this vulnerability is CWE-79 and CWE-352.

How can an unauthenticated attacker exploit this vulnerability?

An unauthenticated attacker can exploit this vulnerability by conducting a stored XSS attack against a user of the interface.

Is there a fix available for CVE-2018-0444?

Yes, Cisco has released a security advisory with details on how to fix this vulnerability. Please refer to the Cisco Security Advisory for more information.