Cross-Frame Scripting Vulnerability in Cisco Unified Communications Manager
CVE-2018-0355

6.1MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Unified Communications Manager Unknown
Vendor
CVE Published:
7 June 2018

Summary

A vulnerability in the web UI of Cisco Unified Communications Manager exposes users to potential cross-frame scripting (XFS) attacks. This issue arises from inadequate protections around HTML inline frames (iframes) in the affected software's web interface. Malicious actors could exploit this by persuading users to visit a compromised web page that contains harmful HTML iframes. The exploit could enable click-jacking and other client-side attacks, posing significant security risks to users of the web UI.

Affected Version(s)

Cisco Unified Communications Manager unknown Cisco Unified Communications Manager unknown

References

http://www.securityfocus.com/bid/104425
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1041068
vdb-entryx_refsource_SECTRACK
https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.