Cisco Unified Communications Manager CVE-2017-12258 Cross Frame Scripting Vulnerability

Bugtraq ID:	101172
Class:	Input Validation Error
CVE:	CVE-2017-12258
Remote:	Yes
Local:	No
Published:	Oct 04 2017 12:00AM
Updated:	Oct 04 2017 12:00AM
Credit:	Loudiyi Mohamed
Vulnerable:	Cisco Unified Communications Manager 9.1(2)
Not Vulnerable:

Cisco Unified Communications Manager CVE-2017-12258 Cross Frame Scripting Vulnerability

Cisco Unified Communications Manager is prone to a cross-frame scripting vulnerability.

Successful exploits will allow attackers to bypass the same-origin policy and perform unauthorized actions; other attacks are possible.

This issue is being tracked by Cisco Bug ID CSCve60993.

Cisco Unified Communications Manager CVE-2017-12258 Cross Frame Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Cisco Unified Communications Manager CVE-2017-12258 Cross Frame Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified Communications Manager CVE-2017-12258 Cross Frame Scripting Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Identity Services Engine Homepage (Cisco)
  
• Cisco Unified Communications Manager Cross-Frame Scripting Vulnerability (Cisco)