Cisco Unified Communications Manager Web Framework Parameter cross site scripting

Summaryinfo

A vulnerability was found in Cisco Unified Communications Manager. It has been declared as problematic. This issue affects some unknown processing of the component Web Framework. The manipulation as part of Parameter results in cross site scripting. This vulnerability is cataloged as CVE-2018-0340. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Cisco Unified Communications Manager (Unified Communication Software) (version now known). Affected is some unknown processing of the component Web Framework. The manipulation as part of a Parameter leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvj00512.

The bug was discovered 06/06/2018. The weakness was shared 06/07/2018 as cisco-sa-20180606-ucm-xss / CSCvj00512 as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2018-0340 since 11/27/2017. It is possible to launch the attack remotely. Required for exploitation is a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316273 (Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (cisco-sa-20180606-ucm-xss)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 104448†). The entry VDB-119248 is related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Unified Communications Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion