20220706 Cisco Unified Communications Products Cross-Site Scripting Vulnerability

The version of Cisco Unified Communications Manager installed on the remote host is version 14 prior to 14SU2. It is, therefore affect by a cross-site scripting vulnerability (XSS) in the web-based management interface. An unauthenticated remote attacker can, with the action of an authorized user, execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cisco Unified Communications Manager IM & Presence Service installed on the remote host is 11.5(1) prior to 11.5(1)SU11, 12.5(1) prior to 12.5(1)SU6 or 14 prior to 14SU2. It is, therefore affect by a cross-site scripting vulnerability (XSS) in the web-based management interface. An unauthenticated remote attacker can, with the action of an authorized user, execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
163102	Cisco Unified Communications Manager XSS (cisco-sa-cucm-xss-ksKd5yfA)	Nessus	CISCO	medium
163101	Cisco Unified Communications Manager IM & Presence XSS (cisco-sa-cucm-xss-ksKd5yfA)	Nessus	CISCO	medium

CVE-2022-20815

medium

Tenable Plugins

medium

medium