← Back to CVEs
CVE-2017-12212
N/ADescription
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345.
CVE Details
CVSS v3.1 ScoreN/A
Published9/7/2017
Last Modified4/20/2025
Sourcenvd
Honeypot Sightings0
Affected Products
cisco:unity_connection
Weaknesses (CWE)
CWE-79CWE-79
References
http://www.securityfocus.com/bid/100645(psirt@cisco.com)
http://www.securitytracker.com/id/1039277(psirt@cisco.com)
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf25345(psirt@cisco.com)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuc(psirt@cisco.com)
http://www.securityfocus.com/bid/100645(af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1039277(af854a3a-2127-422b-91ae-364da2661108)
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf25345(af854a3a-2127-422b-91ae-364da2661108)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuc(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.