Published: 21/06/2006 Updated: 18/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 prior to 3.3(5)SR3, 4.1 prior to 4.1(3)SR4, 4.2 prior to 4.2(3), and 4.3 prior to 4.3(1), allows remote malicious users to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2) arbitrary parameters in ccmuser/logon.asp, aka bugid CSCsb68657.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco call manager 3.3\\(4\\)es25
cisco call manager 3.3\\(5\\)
cisco call manager 3.3\\(5\\)es30
cisco call manager 4.1\\(3\\)es32
cisco call manager 3.3
cisco call manager 4.1
cisco call manager 4.1\\(2\\)es33
cisco call manager 4.2
cisco call manager 4.2\\(1\\)
cisco call manager 3.3\\(5\\)sr1
cisco call manager 3.3\\(5\\)sr2
cisco call manager 4.1\\(3\\)sr2
cisco call manager 4.1\\(3\\)sr3
cisco call manager 4.1\\(3\\)sr1
cisco call manager 4.3\\(1\\)
cisco call manager 3.3\\(3\\)
cisco call manager 3.3\\(3\\)es61
cisco call manager 4.1\\(2\\)es55
cisco call manager 4.1\\(3\\)es07
cisco call manager 4.2\\(2\\)
cisco call manager 4.3

Cisco CallManager versions prior to 43(1), 42(3), 41(3)SR4 and 33(5)SR3 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary script in the user's browser session The vulnerability exists due to improper input sanitization in the CallManager Administration web interface and the CallManager User Optio ...

source: wwwsecurityfocuscom/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability This issue is due to a failure in the web-interface to properly sanitize user-supplied input An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting administrative user in th ...

source: wwwsecurityfocuscom/bid/18504/info Cisco CallManager is prone to a cross-site scripting vulnerability This issue is due to a failure in the web-interface to properly sanitize user-supplied input An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting administrative user in ...

NVD-CWE-Other http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047015.html http://www.fishnetsecurity.com/csirt/disclosure/cisco/Cisco+CallManager+XSS+Advisory.htm http://www.cisco.com/en/US/products/sw/voicesw/ps556/tsd_products_security_response09186a00806c0846.html http://www.securityfocus.com/bid/18504 http://securitytracker.com/id?1016328 http://secunia.com/advisories/20735 http://www.osvdb.org/26651 http://www.osvdb.org/26652 http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047019.html http://securityreason.com/securityalert/1114 http://www.vupen.com/english/advisories/2006/2443 https://exchange.xforce.ibmcloud.com/vulnerabilities/27225 http://www.securityfocus.com/archive/1/437757/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/28061/http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20060619-CVE-2006-3109

CVE-2006-3109

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect