CVE-2018-0199

Опубликовано: 22 фев. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. An exploit could allow the attacker to perform remote code execution. Cisco Bug IDs: CSCve53989.

Ссылки

http://www.securityfocus.com/bid/103143
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040407
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf
Vendor Advisory
http://www.securityfocus.com/bid/103143
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040407
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:jabber:11.9:*:*:*:*:windows:*:*

cpe:2.3:a:cisco:jabber:11.9\(0\):*:*:*:*:windows:*:*

Конфигурация 2

cpe:2.3:a:cisco:jabber:-:*:*:*:*:mac_os_x:*:*

EPSS

Процентиль: 65%

0.00481

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-jfcj-v8f4-wj2w