CVE-2017-12258CWE-59

A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting…

published October 5, 2017

CVSS
—
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. The vulnerability exists because the affected software does not provide sufficient protections for HTML inline frames (iframes). An attacker could exploit this vulnerability by directing a user of the affected software to an attacker-controlled web page that contains a malicious HTML inline frame. A successful exploit could allow the attacker to conduct click-jacking or other types of client-side browser attacks. Cisco Bug IDs: CSCve60993.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01686 · 76.7th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2017-10-05T07:00Z
EPSS history
Timeline
  • 05 OCT 07:00Z
    A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting…
    cvelistv5