Description
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Problem types
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Product status
14
14SU1
14SU2
14SU3
14SU3a
15
15SU1
14SU4
15SU2
15SU3
14SU5
15SU4
References
sec.cloudapps.cisco.com/...ory/cisco-sa-unity-vulns-n2EJSbbw (cisco-sa-unity-vulns-n2EJSbbw)