cisco-sa-20200122-uc-xss: Cisco Unity Connection Stored Cross-Site Scripting Vulnerability
First published: Wed Jan 22 2020(Updated: )
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by providing crafted data to a specific field within the interface. A successful exploit could allow the attacker to store an XSS attack within the interface. This stored XSS attack would then be executed on the system of any user viewing the attacker-supplied data element. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-uc-xss
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unity Connection 8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20200122-uc-xss?
The severity level of cisco-sa-20200122-uc-xss is critical due to its potential for allowing stored cross-site scripting attacks.
How do I fix cisco-sa-20200122-uc-xss?
To fix cisco-sa-20200122-uc-xss, apply the necessary patches and updates provided by Cisco for Unity Connection.
Who is affected by cisco-sa-20200122-uc-xss?
cisco-sa-20200122-uc-xss affects users of Cisco Unity Connection software, specifically version 8.6.
What can an attacker do with cisco-sa-20200122-uc-xss?
An attacker can exploit cisco-sa-20200122-uc-xss to execute arbitrary script code in the context of the affected web interface.
What are the symptoms of exploitation of cisco-sa-20200122-uc-xss?
Symptoms of exploitation of cisco-sa-20200122-uc-xss may include unauthorized script execution that compromises user sessions or data.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/title
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unity connection 8.6