CVE-2014-3313

Summary

CVE	CVE-2014-3313
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2014-07-09 11:07:00 UTC
Updated	2017-08-29 01:34:00 UTC
Description	Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Cisco	Spa901 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa901 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa922 1-line Ip Phone With 1-port Ethernet	All	All	All	All
Hardware	Cisco	Spa922 1-line Ip Phone With 1-port Ethernet	All	All	All	All
Hardware	Cisco	Spa941 4-line Ip Phone With 1-port Ethernet	All	All	All	All
Hardware	Cisco	Spa941 4-line Ip Phone With 1-port Ethernet	All	All	All	All
Hardware	Cisco	Spa942 4-line Ip Phone With 2-port Switch	All	All	All	All
Hardware	Cisco	Spa942 4-line Ip Phone With 2-port Switch	All	All	All	All
Hardware	Cisco	Spa962 6-line Ip Phone With 2-port Switch	All	All	All	All
Hardware	Cisco	Spa962 6-line Ip Phone With 2-port Switch	All	All	All	All
Hardware	Cisco	Spa 301 1 Line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 301 1 Line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 303 3 Line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 303 3 Line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 501g 8-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 501g 8-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 502g 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 502g 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 504g 4-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 504g 4-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 508g 8-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 508g 8-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 509g 12-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 509g 12-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 512g 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 512g 1-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 514g 4-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 514g 4-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 525g2 5-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 525g2 5-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 525g 5-line Ip Phone	All	All	All	All
Hardware	Cisco	Spa 525g 5-line Ip Phone	All	All	All	All

References

Reference	Source	Link	Tags
20140708 Cisco Small Business SPA300 and SPA500 Series IP Phones Cross-Site Scripting Vulnerability	CISCO	tools.cisco.com	Vendor Advisory
tools.cisco.com/security/center/viewAlert.x	CONFIRM	tools.cisco.com	Vendor Advisory
Cisco Small Business SPA300/SPA500 IP Phones Input Validation Flaw Permits Cross-Site Scripting Attacks - SecurityTracker	SECTRACK	www.securitytracker.com
Security Advisory SA59808 - Cisco SPA300 / SPA500 Series IP Phones Cross-Site Scripting Vulnerability - Secunia	SECUNIA	secunia.com
IBM X-Force Exchange	XF	exchange.xforce.ibmcloud.com
Cisco SPA300 and SPA500 Series IP Phones Unspecified Cross Site Scripting Vulnerability	BID	www.securityfocus.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.