CVE-2014-2125

EUVD-2014-2165
Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
ciscounity_connection
𝑥
≤ 8.6
ciscounity_connection
8.6
ciscounity_connection
8.6:\(1\)
ciscounity_connection
8.6:\(2\)
ciscounity_connection
8.6:\(2a\)su1
ciscounity_connection
8.6:\(2a\)su2
ciscounity_connection
8.6\(1a\)
ciscounity_connection
8.6\(2a\)
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125
http://tools.cisco.com/security/center/viewAlert.x?alertId=33603
http://www.securitytracker.com/id/1029988
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125
http://tools.cisco.com/security/center/viewAlert.x?alertId=33603
http://www.securitytracker.com/id/1029988