DOM-based Cross-Site Scripting Vulnerability in Cisco Unified Intelligence Center

CVE-2017-12254

Summary

A vulnerability in the web interface of Cisco Unified Intelligence Center can be exploited by unauthenticated remote attackers to execute a DOM-based cross-site scripting attack. This vulnerability arises from inadequate input validation of certain parameters handled by the web server. Attackers could leverage this weakness by luring users to click on a compromised link or by intercepting requests to inject malicious scripts. Successful exploitation may enable attackers to execute arbitrary code within the browser context of the affected site or gain access to sensitive information stored in the user's browser.

References