low3.5Public exploit code
CVE-2011-2544
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inj…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cisco TelePresence SOS-11-010 - Multiple Vulnerabilities2011-09-19 · webapps · hardware
Impact
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF) attacks that change passwords or cause a denial of service, aka Bug ID CSCtq46488.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Telepresence System 1000 Mxp | All versions |
| Cisco | Telepresence System 1700 Mxp | All versions |
| Cisco | Telepresence Mxp Software | through f9.1 Versions f8.2, f9.0, f9.0.1, f9.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/46057
- http://secunia.com/advisories/46109
- http://securityreason.com/securityalert/8393
- http://securitytracker.com/id?1026072
- http://www.exploit-db.com/exploits/17871
- http://www.securityfocus.com/archive/1/519698/100/0/threaded
- http://www.securityfocus.com/bid/49670
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69906
- http://secunia.com/advisories/46057
- http://secunia.com/advisories/46109
- http://securityreason.com/securityalert/8393
- http://securitytracker.com/id?1026072
- http://www.exploit-db.com/exploits/17871
- http://www.securityfocus.com/archive/1/519698/100/0/threaded
- http://www.securityfocus.com/bid/49670
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69906