Details of VAR-201601-0046

ID

VAR-201601-0046

CVE

CVE-2016-1304

TITLE

Cisco Unity Connection Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2016-001347

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux82596. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by the Cisco Bug ID CSCux82596. Cisco Unity Connection (UC) is a set of voice message platform of Cisco (Cisco). The platform can use voice commands to make calls or listen to messages "hands-free"

Trust: 2.07

sources: NVD: CVE-2016-1304 // JVNDB: JVNDB-2016-001347 // BID: 82231 // VULHUB: VHN-90123 // VULMON: CVE-2016-1304

AFFECTED PRODUCTS

vendor:	cisco	model:	unity connection	scope:	eq	version:	10.5\(2.3009\)	Trust: 1.6
vendor:	cisco	model:	unity connection	scope:	eq	version:	10.5(2.3009)	Trust: 1.1

sources: BID: 82231 // JVNDB: JVNDB-2016-001347 // CNNVD: CNNVD-201601-687 // NVD: CVE-2016-1304

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-1304
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-1304
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201601-687
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-90123
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2016-1304
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-1304
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-90123
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1304
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-90123 // VULMON: CVE-2016-1304 // JVNDB: JVNDB-2016-001347 // CNNVD: CNNVD-201601-687 // NVD: CVE-2016-1304

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-90123 // JVNDB: JVNDB-2016-001347 // NVD: CVE-2016-1304

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-687

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201601-687

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-001347

PATCH

title:	cisco-sa-20160128-uc	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160128-uc	Trust: 0.8
title:	Cisco: Cisco Unity Connection User Search Cross-Site Scripting Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20160128-uc	Trust: 0.1

sources: VULMON: CVE-2016-1304 // JVNDB: JVNDB-2016-001347

EXTERNAL IDS

db:	NVD	id:	CVE-2016-1304	Trust: 2.9
db:	SECTRACK	id:	1034868	Trust: 1.2
db:	JVNDB	id:	JVNDB-2016-001347	Trust: 0.8
db:	CNNVD	id:	CNNVD-201601-687	Trust: 0.7
db:	BID	id:	82231	Trust: 0.5
db:	VULHUB	id:	VHN-90123	Trust: 0.1
db:	VULMON	id:	CVE-2016-1304	Trust: 0.1

sources: VULHUB: VHN-90123 // VULMON: CVE-2016-1304 // BID: 82231 // JVNDB: JVNDB-2016-001347 // CNNVD: CNNVD-201601-687 // NVD: CVE-2016-1304

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160128-uc	Trust: 2.2
url:	http://www.securitytracker.com/id/1034868	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1304	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1304	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.securityfocus.com/bid/82231	Trust: 0.1

sources: VULHUB: VHN-90123 // VULMON: CVE-2016-1304 // BID: 82231 // JVNDB: JVNDB-2016-001347 // CNNVD: CNNVD-201601-687 // NVD: CVE-2016-1304

CREDITS

Cisco

Trust: 0.3

sources: BID: 82231

SOURCES

db:	VULHUB	id:	VHN-90123
db:	VULMON	id:	CVE-2016-1304
db:	BID	id:	82231
db:	JVNDB	id:	JVNDB-2016-001347
db:	CNNVD	id:	CNNVD-201601-687
db:	NVD	id:	CVE-2016-1304

LAST UPDATE DATE

2024-11-23T22:22:48.230000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-90123	date:	2016-12-06T00:00:00
db:	VULMON	id:	CVE-2016-1304	date:	2016-12-06T00:00:00
db:	BID	id:	82231	date:	2016-01-28T00:00:00
db:	JVNDB	id:	JVNDB-2016-001347	date:	2016-02-10T00:00:00
db:	CNNVD	id:	CNNVD-201601-687	date:	2016-02-01T00:00:00
db:	NVD	id:	CVE-2016-1304	date:	2024-11-21T02:46:09.167

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-90123	date:	2016-01-30T00:00:00
db:	VULMON	id:	CVE-2016-1304	date:	2016-01-30T00:00:00
db:	BID	id:	82231	date:	2016-01-28T00:00:00
db:	JVNDB	id:	JVNDB-2016-001347	date:	2016-02-10T00:00:00
db:	CNNVD	id:	CNNVD-201601-687	date:	2016-01-30T00:00:00
db:	NVD	id:	CVE-2016-1304	date:	2016-01-30T12:59:02.243