News
Vigil@nce - Cisco Unified Communications Manager: Cross Site Scripting of IM and Presence Service
October 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can trigger a Cross Site Scripting in IM and Presence
Service of Cisco Unified Communications Manager, in order to run
JavaScript code in the context of the web site.
– Impacted products: Cisco CUCM.
– Severity: 2/4.
– Creation date: 03/08/2015.
DESCRIPTION OF THE VULNERABILITY
The Cisco Unified Communications Manager product offers a web
service.
However, it does not filter received data before inserting them in
generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting in IM and
Presence Service of Cisco Unified Communications Manager, in order
to run JavaScript code in the context of the web site.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
