Lucene search

[email protected]CVE-2016-1377

HistoryApr 12, 2016 - 11:59 p.m.

CVE-2016-1377

2016-04-1223:59:35

CWE-79

[email protected]

web.nvd.nist.gov

cve-2016-1377

cross-site scripting

xss vulnerability

cisco unity connection

bug id cscus21776

nvd

information security

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.5%

JSON

Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCus21776.

Affected configurations

NVD

Node

ciscounity_connectionMatch10.0.0

ciscounity_connectionMatch10.0.5

ciscounity_connectionMatch10.5\(2\)

ciscounity_connectionMatch10.5\(2.3009\)

ciscounity_connectionMatch11.0\(0.98000.225\)

ciscounity_connectionMatch11.0.0

CPENameOperatorVersion
cisco:unity_connectioncisco unity connectioneq10.0.0
cisco:unity_connectioncisco unity connectioneq10.0.5
cisco:unity_connectioncisco unity connectioneq10.5\(2\)
cisco:unity_connectioncisco unity connectioneq10.5\(2.3009\)
cisco:unity_connectioncisco unity connectioneq11.0\(0.98000.225\)
cisco:unity_connectioncisco unity connectioneq11.0.0

CPE	Name	Operator	Version
cisco:unity_connection	cisco unity connection	eq	10.0.0
cisco:unity_connection	cisco unity connection	eq	10.0.5
cisco:unity_connection	cisco unity connection	eq	10.5\(2\)
cisco:unity_connection	cisco unity connection	eq	10.5\(2.3009\)
cisco:unity_connection	cisco unity connection	eq	11.0\(0.98000.225\)
cisco:unity_connection	cisco unity connection	eq	11.0.0

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-unity

www.securitytracker.com/id/1035562

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.5%

JSON

Related for CVE-2016-1377

cvelist1 nvd1 prion1 cisco1