CVE-2014-2125

Cross-site scripting (XSS) vulnerability in the Web Inbox in Cisco Unity Connection 8.6(2a)SU3 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui33028.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
ciscoCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
VendorProductVersion
ciscounity_connection
𝑥
≤ 8.6
ciscounity_connection
8.6
ciscounity_connection
8.6:\(1\)
ciscounity_connection
8.6:\(2\)
ciscounity_connection
8.6:\(2a\)su1
ciscounity_connection
8.6:\(2a\)su2
ciscounity_connection
8.6\(1a\)
ciscounity_connection
8.6\(2a\)
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125
http://tools.cisco.com/security/center/viewAlert.x?alertId=33603
http://www.securitytracker.com/id/1029988
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2125
http://tools.cisco.com/security/center/viewAlert.x?alertId=33603
http://www.securitytracker.com/id/1029988