CVE-2008-4542 Cross-site scripting (XSS) vulnerability in Cisco Unity 4.x before 4.2(1)ES162, 5.x before 5.0(1)ES56, and 7.x before 7.0(2)ES8 allows remote authenticated administrators to inject arbitrary web scrip...
LowCVSS 3.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Cisco Unity 4.x before 4.2(1)ES162, 5.x before 5.0(1)ES56, and 7.x before 7.0(2)ES8 allows remote authenticated administrators to inject arbitrary web script or HTML by entering it in the database (aka data store).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco unity | <= 4.2\(1\) | No fix listed |
| cisco unity | <= 5.0\(1\) | No fix listed |
| cisco unity | <= 7.0\(2\) | No fix listed |
| cisco unity | = 4.0 | No fix listed |
| cisco unity | = 4.0(1) | No fix listed |
| cisco unity | = 4.0(2) | No fix listed |
| cisco unity | = 4.0(3) | No fix listed |
| cisco unity | = 4.0(3)-sr2 | No fix listed |
| cisco unity | = 4.0(4) | No fix listed |
| cisco unity | = 4.0(4)-sr1 | No fix listed |
| cisco unity | = 4.0(5) | No fix listed |
| cisco unity | = 4.1(1) | No fix listed |
| cisco unity | = 5.0 | No fix listed |
| cisco unity | = 7.0 | No fix listed |
References
- 32207 third-party-advisory vendor-advisory
- 1021012 vdb-entry
- 20081008 VoIPshield Reported Vulnerabilities in Cisco Unity Server vendor-advisory
- 31642 vdb-entry
- www.voipshield.com
- ADV-2008-2771 vdb-entry
- cisco-unityserver-stored-data-xss(45744) vdb-entry