CVE-2017-6654

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 10.5 through 11.5

Description A cross-site scripting (XSS) issue exists due to insufficient validation of user-supplied input by the web-based management interface. This could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface by persuading them to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Recommendations For Cisco Unified Communications Manager versions 10.5 through 11.5, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid clicking on crafted links from untrusted sources to prevent potential attacks.