CVE-1999-1167 in Web
Summary
by MITRE
Cross-site scripting vulnerability in Third Voice Web annotation utility allows remote users to read sensitive data and generate fake web pages for other Third Voice users by injecting malicious Javascript into an annotation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/20/2026
This cross-site scripting vulnerability exists within the Third Voice Web annotation utility, representing a critical security flaw that enables remote attackers to manipulate web content and access sensitive information. The vulnerability stems from insufficient input validation and output encoding mechanisms within the annotation processing system, allowing malicious actors to inject javascript code that executes in the context of other users' browsers. The flaw specifically affects how the application handles user-supplied annotation data, failing to properly sanitize or escape special characters that could be interpreted as executable code by web browsers.
The technical implementation of this vulnerability aligns with CWE-79, which categorizes cross-site scripting as a code injection flaw where untrusted data is improperly incorporated into web pages without proper validation or encoding. Attackers can exploit this weakness by crafting malicious annotations containing javascript payloads that get stored and subsequently executed when other users view the annotated content. This creates a persistent threat vector where the injected code can access session cookies, form data, and other sensitive information available within the user's browser context.
The operational impact of this vulnerability extends beyond simple data theft, as it enables attackers to create convincing fake web pages that appear legitimate to other users. This capability allows for sophisticated social engineering attacks where users might be tricked into believing they are interacting with authentic Third Voice services while actually executing malicious code. The vulnerability is particularly dangerous because it operates at the user level rather than the server level, making it difficult to detect and prevent through traditional network monitoring approaches.
Security professionals should consider this vulnerability in the context of ATT&CK technique T1566, which covers social engineering through malicious content delivery. The attack chain typically involves initial compromise through annotation injection followed by credential theft, data exfiltration, or further exploitation of the compromised user sessions. Organizations should implement comprehensive input validation mechanisms, employ proper output encoding for all user-generated content, and consider implementing content security policies to mitigate such attacks. Additionally, regular security testing and code reviews focusing on data sanitization practices are essential to prevent similar vulnerabilities from emerging in web applications that process user input.