CVE-2018-0328
A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, rem…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvg89116.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.75% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- n/a Cisco Unified Communications Manager and Cisco Unified Presence
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securitytracker.com /id/1040929 · vdb-entry, x_refsource_SECTRACK, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-cucm-cup-xss · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1040928 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/104200 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-0328
- NVD: CVE-2018-0328
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.