Lucene search

CiscoCVE-2018-0400

HistoryJul 18, 2018 - 11:29 p.m.

CVE-2018-0400

2018-07-1823:29:01

CWE-79

cisco

web.nvd.nist.gov

cve-2018-0400

web-based management interface

cisco unified contact center express

xss

nvd

cve

cscvg70904

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.0%

JSON

Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70904.

Affected configurations

Nvd

Node

ciscounified_contact_center_expressMatch11.5\(1\)

ciscounified_ip_interactive_voice_responseMatch11.5\(1\)

VendorProductVersionCPE
ciscounified_contact_center_express11.5(1)cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\):*:*:*:*:*:*:*
ciscounified_ip_interactive_voice_response11.5(1)cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.5\(1\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	unified_contact_center_express	11.5(1)	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\):::::::*
cisco	unified_ip_interactive_voice_response	11.5(1)	cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.5\(1\):::::::*

CNA Affected

[
  {
    "product": "Cisco Unified Contact Center Express unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Unified Contact Center Express unknown"
      }
    ]
  }
]

References

www.securitytracker.com/id/1041352

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-uccx

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.0%

JSON

Related for CVE-2018-0400