CVE-2014-3363

Published: Sep 12, 2014Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Manager (UCM) 9.1(2.10000.28) allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq68443.

Affected (1)

Products: Cisco: Unified Communications Manager

Cisco

1 product

Unified Communications Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Unified Communications Manager	Version 9.1(2.10000.28)

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (12)

http://secunia.com/advisories/59105

Source: psirt@cisco.com

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3363

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/viewAlert.x?alertId=35672

Source: psirt@cisco.com

Vendor Advisory

http://www.securityfocus.com/bid/69739

Source: psirt@cisco.com

http://www.securitytracker.com/id/1030836

Source: psirt@cisco.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/95882

Source: psirt@cisco.com

http://secunia.com/advisories/59105