CVE-2019-1702: XSS
First published: Mon Mar 11 2019(Updated: )
Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities either by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. In both cases, the attacker must persuade the user to click the crafted link or open the chat window that contains the attacker's code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Version 11.6(1) is affected.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Enterprise Chat and Email | =11.6\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-1702?
The severity of CVE-2019-1702 is medium.
What is the affected software for CVE-2019-1702?
The affected software for CVE-2019-1702 is Cisco Enterprise Chat and Email version 11.6(1).
How can an unauthenticated, remote attacker exploit CVE-2019-1702?
An unauthenticated, remote attacker can exploit CVE-2019-1702 by conducting a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software.
Are there any references for CVE-2019-1702?
Yes, there are references available for CVE-2019-1702. You can find them at the following links: [SecurityFocus](http://www.securityfocus.com/bid/107314) and [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-chatmail-xss).
What is the Common Weakness Enumeration (CWE) for CVE-2019-1702?
The Common Weakness Enumeration (CWE) for CVE-2019-1702 is CWE-79, which corresponds to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- collector/nvd-index
- vendor/cisco
- canonical/cisco enterprise chat and email
- version/cisco enterprise chat and email/11.6\(1\)