CVE-2007-2832
Summary
| CVE | CVE-2007-2832 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-05-24 02:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to CCMAdmin/serverlist.asp (aka the search-form) and possibly other unspecified vectors. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:N/I:P/A:N
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Cisco | Call Manager | 3.3 | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(3\) | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(3\)es61 | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(4\)es25 | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(5\) | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(5\)es30 | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(5\)sr1 | All | All | All |
| Hardware | Cisco | Call Manager | 3.3\(5\)sr2 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(2\)es33 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(2\)es55 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(3\)es07 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(3\)es32 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(3\)sr1 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(3\)sr2 | All | All | All |
| Hardware | Cisco | Call Manager | 4.1\(3\)sr3 | All | All | All |
| Hardware | Cisco | Call Manager | 4.2\(3\) | All | All | All |
| Hardware | Cisco | Call Manager | 4.2\(3\)sr1 | All | All | All |
| Hardware | Cisco | Call Manager | 4.3\(1\) | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.osvdb.org/35337 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| scip AG [Security - Consulting - Information - Process] | af854a3a-2127-422b-91ae-364da2661108 | www.scip.ch | |
| Cisco CallManager Cross-Site Scripting Vulnerability - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Patch, Vendor Advisory |
| Cisco CallManager Search Form Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Cisco CallManager Input Validation Vulnerability - Cisco Systems | af854a3a-2127-422b-91ae-364da2661108 | www.cisco.com | |
| '[Full-disclosure] Cisco CallManager 4.1 Input Validation' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Exploit, Vendor Advisory |
| Cisco CallManager Input Validation Hole in Search Form Permits Cross-Site Scripting Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.