ID CISCO-SA-20140401-CVE-2014-2125 Type cisco Reporter Cisco Modified 2014-04-01T18:55:36
Description
A vulnerability in Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
The vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this vulnerability by persuading a user to access a malicious link.
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.
Cisco indicates through the CVSS score that proof-of-concept exploit code exists; however, the code is not known to be publicly available.
{"viewCount": 0, "reporter": "Cisco", "references": ["http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140401-CVE-2014-2125"], "description": "A vulnerability in Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.\n\nThe vulnerability is due to insufficient input validation of a parameter. An attacker could exploit this vulnerability by persuading a user to access a malicious link.\n\nCisco has confirmed the vulnerability in a security notice and released software updates.\n\nTo exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.\n\nCisco indicates through the CVSS score that proof-of-concept exploit code exists; however, the code is not known to be publicly available.", "affectedSoftware": [{"version": "any", "operator": "eq", "name": "Cisco Unity Connection"}], "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140401-CVE-2014-2125", "modified": "2014-04-01T18:55:36", "objectVersion": "1.4", "_object_types": ["robots.models.cisco.CiscoBulletin", "robots.models.base.Bulletin"], "enchantments": {"score": {"value": 4.3, "vector": "NONE"}, "vulnersScore": 4.3}, "id": "CISCO-SA-20140401-CVE-2014-2125", "title": "Cisco Unity Connection Cross-Site Scripting Vulnerability", "bulletinFamily": "software", "published": "2014-04-01T18:55:42", "enchantments_done": [], "type": "cisco", "_object_type": "robots.models.cisco.CiscoBulletin", "history": [], "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "cvelist": ["CVE-2014-2125"], "lastseen": "2017-09-26T15:33:56"}
