Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2018-15434

Опубликовано: 05 окт. 2018
Источник: nvd
CVSS3: 6.1
CVSS2: 4.3
EPSS Низкий

Описание

A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:cisco:skinny_client_control_protocol_software:9.4\(2\):*:*:*:*:*:*:*

Одно из

cpe:2.3:h:cisco:unified_ip_phones_7906g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7911g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7912g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7920_multi-charger:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7921g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7925g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7925g-ex:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7926g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7931g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7940g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7941g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7942g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7945g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7960g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7961g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7962g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7965g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7975g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_conference_station_7936:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_conference_station_7937g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_expansion_module_7915:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_expansion_module_7916:*:*:*:*:*:*:*:*

EPSS

Процентиль: 55%
0.00319
Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79

Связанные уязвимости

github логотип

GHSA-hgxm-hvqw-9m6p

CVSS3: 6.1
github
больше 3 лет назад

A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

fstec логотип

BDU:2019-00092

CVSS3: 6.1
fstec
больше 7 лет назад

Уязвимость веб-интерфейса микропрограммного обеспечения IP-телефона Cisco Unified IP Phone 7900 Series, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю внедрить произвольный код в загружаемую веб-страницу или раскрыть защищаемую информацию

EPSS

Процентиль: 55%
0.00319
Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79