Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
BID:53432
Info
Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 53432 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4232 |
| Remote: | Yes |
| Local: | No |
| Published: | May 09 2012 12:00AM |
| Updated: | May 09 2012 12:00AM |
| Credit: | Cisco |
| Vulnerable: |
Cisco Unified MeetingPlace 6.0.639 .3 Cisco Unified MeetingPlace 6.0.639 .2 Cisco Unified MeetingPlace 6 |
| Not Vulnerable: |
Cisco Unified MeetingPlace 6.1.1.4 (MR1) |
Discussion
Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
Cisco Unified MeetingPlace is prone to a directory enumeration weakness and multiple cross-site scripting vulnerabilities.
A remote attacker can exploit the directory-enumeration weakness to enumerate existing folders; other attacks are also possible.
Attackers can also execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This will allow attackers to steal cookie-based authentication credentials and launch other attacks.
Cisco Unified MeetingPlace is prone to a directory enumeration weakness and multiple cross-site scripting vulnerabilities.
A remote attacker can exploit the directory-enumeration weakness to enumerate existing folders; other attacks are also possible.
Attackers can also execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This will allow attackers to steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Cisco Unified MeetingPlace Directory Enumeration Weakness and Cross Site Scripting Vulnerabilities
References:
References: