Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability

medium Nessus Plugin ID 129817

Language:

Synopsis

The remote host is missing a vendor-supplied security patch.

Description

Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652.

Solution

Apply the patch or upgrade to the version recommended in Cisco bug ID CSCuy75020 or CSCuy81652

Plugin Details

Severity: Medium

ID: 129817

File Name: cisco-sa-20161005-ucis1.nasl

Version: 1.3

Type: local

Family: CISCO

Published: 10/11/2019

Updated: 10/17/2019

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2016-6425

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:unified_intelligence_center

Required KB Items: installed_sw/Cisco Unified Intelligence Center (CUIC), Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2016

Vulnerability Publication Date: 10/5/2016

Reference Information

CVE: CVE-2016-6425

BID: 93422

CWE: 79

CISCO-SA: cisco-sa-20161005-ucis1

CISCO-BUG-ID: CSCuy75020, CSCuy81652

Detections

Analytics