CVE-2018-15434

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-15434
A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www.securitytracker.com/id/1041791 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-uipp-7900-xss Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:cisco:skinny_client_control_protocol_software:9.4\(2\):*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:unified_ip_phones_7906g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7911g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7912g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7920_multi-charger:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7921g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7925g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7925g-ex:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7926g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7931g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7940g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7941g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7942g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7945g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7960g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7961g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7962g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7965g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_7975g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_conference_station_7936:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_conference_station_7937g:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_expansion_module_7915:*:*:*:*:*:*:*:*
cpe:2.3:h:cisco:unified_ip_phones_expansion_module_7916:*:*:*:*:*:*:*:*
History

No history.

Information

Published : 2018-10-05 14:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-15434

Mitre link : CVE-2018-15434

CVE.ORG link : CVE-2018-15434

JSON object : View

Products Affected

cisco

  • unified_ip_phones_7975g
  • unified_ip_phones_7961g
  • unified_ip_phones_conference_station_7936
  • unified_ip_phones_7925g
  • unified_ip_phones_conference_station_7937g
  • unified_ip_phones_7942g
  • unified_ip_phones_7925g-ex
  • unified_ip_phones_7912g
  • unified_ip_phones_expansion_module_7916
  • unified_ip_phones_7945g
  • unified_ip_phones_7941g
  • unified_ip_phones_7920_multi-charger
  • unified_ip_phones_7940g
  • unified_ip_phones_7960g
  • unified_ip_phones_7962g
  • unified_ip_phones_7965g
  • unified_ip_phones_7926g
  • unified_ip_phones_7921g
  • skinny_client_control_protocol_software
  • unified_ip_phones_7931g
  • unified_ip_phones_7906g
  • unified_ip_phones_7911g
  • unified_ip_phones_expansion_module_7915
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')