PT-2010-2393 · Cisco · Cisco Collaboration Server

S4Squatch

·

CVE-2010-0641

·

Published

2010-02-17

·

Updated

2017-08-17

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Cisco Collaboration Server (CCS) version 5
Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the dest parameter in the /webline/html/admin/wcs/LoginPage.jhtml API endpoint.
Recommendations For Cisco Collaboration Server (CCS) version 5, avoid using the dest parameter in the /webline/html/admin/wcs/LoginPage.jhtml API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-0641

Affected Products

Cisco Collaboration Server