Cisco Unified Communications Manager Cross-Site Scripting (XSS) Vulnerability Advisory

Key Information 1. Vulnerability Description: - Product: Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection. - Vulnerability Type: Cross-Site Scripting (XSS). - Impact: Allows unauthorized remote attackers to execute arbitrary script code or access sensitive browser information by tricking users into clicking malicious links on web pages. 2. Affected Products: - Unified CM and Unified CM SME: - 10.5(2) - 11.5(1) - 12.0(1) - 12.5(1) - Unified CM IM&P Service: - 10.5(2) - 11.5(1) - 12.0(1) - 12.5(1) - Unity Connection: - 10.5(2) - 11.5(1) - 12.0(1) - 12.5(1) 3. Workarounds: - No workarounds available. 4. Fixed Versions: - No fixed versions available. 5. Affected Versions: - Unified CM and Unified CM SME: - 10.5(2)SU10 and earlier - 11.5(1)SU8 and earlier - 12.0(1)SU3 and earlier - 12.5(1)SU2 and earlier - Unified CM IM&P Service: - 10.5(2)SU4a and earlier - 11.5(1)SU8 and earlier - All versions - Unity Connection: - 10.5(2)SU10 and earlier - 11.5(1)SU8 and earlier - 12.0(1)SU3 and earlier - 12.5(1)SU2 and earlier 6. Source: - The vulnerability was discovered during the resolution of a Cisco TAC support case. 7. Security Policy: - Information provided regarding Cisco’s security vulnerability disclosure policy and publications. 8. Rating: - Rated 6.1. Summary This vulnerability allows unauthorized remote attackers to execute arbitrary script code or access sensitive browser information by tricking users into clicking malicious links on web pages. Affected products include Cisco Unified Communications Manager and its associated services.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Unified Communications Manager Cross-Site Scripting (XSS) Vulnerability Advisory