Lucene search

CiscoCVE-2018-0199

HistoryFeb 22, 2018 - 12:29 a.m.

CVE-2018-0199

2018-02-2200:29:00

CWE-79

cisco

web.nvd.nist.gov

cisco

jabber

client framework

jcf

vulnerability

cross-site scripting

xss

remote attacker

cisco bug ids

cscve53989

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.004

Percentile

74.6%

JSON

A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. An exploit could allow the attacker to perform remote code execution. Cisco Bug IDs: CSCve53989.

Affected configurations

Nvd

Node

ciscojabberMatch11.9windows

ciscojabberMatch11.9\(0\)windows

Node

ciscojabberMatch-mac_os_x

VendorProductVersionCPE
ciscojabber11.9cpe:2.3:a:cisco:jabber:11.9:*:*:*:*:windows:*:*
ciscojabber11.9(0)cpe:2.3:a:cisco:jabber:11.9\(0\):*:*:*:*:windows:*:*
ciscojabber-cpe:2.3:a:cisco:jabber:-:*:*:*:*:mac_os_x:*:*

Vendor	Product	Version	CPE
cisco	jabber	11.9	cpe:2.3:a:cisco:jabber:11.9:::::windows::
cisco	jabber	11.9(0)	cpe:2.3:a:cisco:jabber:11.9\(0\):::::windows::
cisco	jabber	-	cpe:2.3:a:cisco:jabber:-:::::mac_os_x::

CNA Affected

[
  {
    "product": "Cisco Jabber Client Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Jabber Client Framework"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103143

www.securitytracker.com/id/1040407

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-jcf

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.004

Percentile

74.6%

JSON

Related for CVE-2018-0199