Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

The Cisco Unity Connection installed on the remote host is prior to version 14. It is, therefore, affected by multiple cross-site Scripting vulnerabilities.

Multiple vulnerabilities in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct an XSS attack against an interface user. An attacker could exploit this vulnerability by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Note that Nessus has not tested formthis issue but has instead relied only on the application's self-reported version number.

The version of cisco unified communications manager installed on the remote host is prior to version 14. It is, therefore, affected by multiple cross-site scripting vulnerabilities.

Multiple vulnerabilities in the web-based management interface of Cisco Unified CM, could allow an unauthenticated, remote attacker to conduct an XSS attack against an interface user. An attacker could exploit this vulnerability by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cisco Unified Communications Manager IM & Presence Service installed on the remote host is prior to version 14. It is, therefore, affected by a cross-site scripting vulnerability.

A vulnerability in the web-based management interface of Cisco Unified CM IM&P,could allow an unauthenticated, remote attacker to conduct an XSS attack against an interface user. An attacker could exploit this vulnerability by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149469	Cisco Unity Connection XSS (cisco-sa-cucm-xss-Q4PZcNzJ)	Nessus	CISCO	medium
149468	Cisco Unified Communications Manager XSS (cisco-sa-cucm-xss-Q4PZcNzJ)	Nessus	CISCO	medium
149467	Cisco Unified Communications Manager IM & Presence Service XSS (cisco-sa-cucm-xss-Q4PZcNzJ)	Nessus	CISCO	medium

Detections

Analytics

CVE-2021-1409

medium

Tenable Plugins

medium

medium

medium