Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2020-3282

Опубликовано: 02 июл. 2020
Источник: nvd
CVSS3: 6.1
CVSS3: 6.1
CVSS2: 4.3
EPSS Низкий

Описание

A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*
Версия от 10.5\(2\) (включая) до 10.5\(2\)su10 (исключая)
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*
Версия от 10.5\(2\) (включая) до 10.5\(2\)su10 (исключая)
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:*:*:*:*
Версия от 11.5\(1\) (включая) до 11.5\(1\)su8 (исключая)
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*
Версия от 11.5\(1\) (включая) до 11.5\(1\)su8 (исключая)
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.0\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:12.5\(1\):*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
Версия от 10.5\(2\) (включая) до 10.5\(2\)su10 (исключая)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
Версия от 11.5\(1\) (включая) до 11.5\(1\)su8 (исключая)
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:12.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*
Версия от 10.5\(2\) (включая) до 10.5\(2\)su10 (исключая)
cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*
Версия от 11.5\(1\) (включая) до 11.5\(1\)su8 (исключая)
cpe:2.3:a:cisco:unity_connection:12.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:12.5\(1\):*:*:*:*:*:*:*

EPSS

Процентиль: 36%
0.00153
Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79

Связанные уязвимости

github логотип

GHSA-fpfg-9g3r-ww3r

github
больше 3 лет назад

A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

fstec логотип

BDU:2020-03438

CVSS3: 6.1
fstec
больше 5 лет назад

Уязвимость веб-интерфейса управления систем обработки вызовов Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM & Presence Service и Cisco Unity Connection, позволяющая нарушителю проводить межсайтовые сценарные атаки

EPSS

Процентиль: 36%
0.00153
Низкий

6.1 Medium

CVSS3

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79
CWE-79