Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2017-12212 | First vendor Publication | 2017-09-07 |
Vendor | Cve | Last vendor Modification | 2019-10-09 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | |||
---|---|---|---|
Overall CVSS Score | 6.1 | ||
Base Score | 6.1 | Environmental Score | 6.1 |
impact SubScore | 2.7 | Temporal Score | 6.1 |
Exploitabality Sub Score | 2.8 | ||
Attack Vector | Network | Attack Complexity | Low |
Privileges Required | None | User Interaction | Required |
Scope | Changed | Confidentiality Impact | Low |
Integrity Impact | Low | Availability Impact | None |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12212 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
Snort® IPS/IDS
Date | Description |
---|---|
2017-10-12 | Cisco Unity Connection serviceParamEdit.do cross site scripting attempt RuleID : 44558 - Revision : 1 - Type : SERVER-WEBAPP |
2017-10-12 | Cisco Unity Connection nick-name.do cross site scripting attempt RuleID : 44557 - Revision : 1 - Type : SERVER-WEBAPP |
2017-10-12 | Cisco Unity Connection edit-nuance.do cross site scripting attempt RuleID : 44556 - Revision : 1 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-09-11 | Name : The version of Cisco Unity Connection on the remote host is affected by a rel... File : cisco_uc_10_5_2.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2021-05-04 12:58:25 |
|
2021-04-22 02:11:18 |
|
2020-05-23 00:55:25 |
|
2019-10-10 05:19:42 |
|
2017-09-18 21:23:50 |
|
2017-09-12 13:25:00 |
|
2017-09-09 09:22:15 |
|
2017-09-08 05:22:21 |
|