News
Vigil@nce - Cisco Unified Communications Manager: Cross Site Scripting of IPMA
February 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can trigger a Cross Site Scripting in IPMA of Cisco
Unified Communications Manager, in order to execute JavaScript
code in the context of the web site.
– Impacted products: Cisco CUCM
– Severity: 2/4
– Creation date: 12/02/2014
DESCRIPTION OF THE VULNERABILITY
The Cisco Unified Communications Manager product offers a web
service.
However, it does not filter received data before inserting them in
generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting in IPMA
(IP Manager Assistant) of Cisco Unified Communications Manager, in
order to execute JavaScript code in the context of the web site.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
