CoreCVE
Back

MEDIUM

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system

Published Jun 7, 2018

Description

A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvf76417.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisco
Published Jun 7, 2018
Updated Nov 29, 2024
Reserved Nov 27, 2017
Link CVE-2018-0354
CISA Vulnrichment
Updated Nov 29, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-0354
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-0354