CVE-2017-12212
MEDIUMCisco Unity Connection - Unauthenticated Reflected Cross-Site Scripting via HTTP GET/POST Parameters
Title source: llmDescription
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1039277
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100645
Vendor Advisory x_refsource_confirm
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf25345
Vendor Advisory x_refsource_confirm
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuc
Scores
CVSS v3
6.1
EPSS
0.0123
EPSS Percentile
65.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
cisco/unity_connection
10.5\(2\)
n/a/Cisco Unity Connection
Cisco Unity Connection
Published
Sep 07, 2017
Tracked Since
Feb 18, 2026