First published: Wed Jul 01 2020(Updated: )
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-cuc-imp-xss-OWuSYAp
Credit: This vulnerability was found during the resolution a Cisco TAC support case
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco Unified CM | =11.5(1)<11.5(1)SU8=10.5(2)<10.5(2)SU10 | 11.5(1)SU8 10.5(2)SU10 |
Cisco Unified CM SME | =11.5(1)<11.5(1)SU8=10.5(2)<10.5(2)SU10 | 11.5(1)SU8 10.5(2)SU10 |
Cisco Unified CM IM&P Service | =11.5(1)<11.5(1)SU8=10.5(2)<10.5(2)SU10 | 11.5(1)SU8 10.5(2)SU10 |
Cisco Unity Connection | =11.5(1)<11.5(1)SU8=10.5(2)<10.5(2)SU10 | 11.5(1)SU8 10.5(2)SU10 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Cisco Unified Communications vulnerability is cisco-sa-cucm-cuc-imp-xss-OWuSYAp.
The severity of cisco-sa-cucm-cuc-imp-xss-OWuSYAp is medium with a severity value of 6.1.
The Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection are affected by cisco-sa-cucm-cuc-imp-xss-OWuSYAp.
Versions 11.5(1)SU8 and 10.5(2)SU10 of the affected Cisco products are vulnerable to cisco-sa-cucm-cuc-imp-xss-OWuSYAp.
To fix cisco-sa-cucm-cuc-imp-xss-OWuSYAp, apply the recommended remedies provided by Cisco.