Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-12707

Опубликовано: 02 окт. 2019
Источник: nvd
CVSS3: 6.1
CVSS3: 6.1
CVSS2: 4.3
EPSS Низкий

Описание

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:unified_communications_manager:10.5\(2.10000.5\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:11.5\(1.10000.6\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1.10000.10\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1.10000.22\):*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:14.0\(1\):*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:a:cisco:unity_connection:11.5:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:12.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:12.5:*:*:*:*:*:*:*

EPSS

Процентиль: 36%
0.00153
Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79

Связанные уязвимости

github логотип

GHSA-xjj5-rj2r-8v2w

CVSS3: 6.1
github
больше 3 лет назад

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

fstec логотип

BDU:2019-04139

CVSS3: 6.1
fstec
больше 6 лет назад

Уязвимость веб-интерфейса управления систем управления IP-телефонией Cisco Unified Communications Manager, Cisco Unified Communications Manager SME, Unified Communications Manager IM and Presence Service и интегрированной системы обмена сообщениями Unity Connection, позволяющая нарушителю выполнить произвольный код или получить доступ к конфиденциальной информации

EPSS

Процентиль: 36%
0.00153
Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79