CVE-2011-2544
Published Sep 23, 2011
Last updated 6 years ago
Overview
- Description
- Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF) attacks that change passwords or cause a denial of service, aka Bug ID CSCtq46488.
- Source
- ykramarz@cisco.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 3.5
- Impact score
- 2.9
- Exploitability score
- 6.8
- Vector string
- AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-79
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:telepresence_system_1000_mxp:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33004D3D-BB6D-424D-B120-20F1F469BE49"
},
{
"criteria": "cpe:2.3:h:cisco:telepresence_system_1700_mxp:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABDE9570-3D4B-48D2-93CA-1C5C20C2BA7E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:telepresence_mxp_software:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6601AFE6-EA74-4EAE-8FF2-1C57676F9FC7",
"versionEndIncluding": "f9.1"
},
{
"criteria": "cpe:2.3:a:cisco:telepresence_mxp_software:f8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5DE1AE6C-A4A2-4B30-908C-B762C7FF3731"
},
{
"criteria": "cpe:2.3:a:cisco:telepresence_mxp_software:f9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35C323D0-15A4-4639-9DDC-513BD7EEC5E1"
},
{
"criteria": "cpe:2.3:a:cisco:telepresence_mxp_software:f9.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B30A62F0-46F1-4F5E-9359-034609462F37"
},
{
"criteria": "cpe:2.3:a:cisco:telepresence_mxp_software:f9.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4E634F54-2913-4BAD-A6C6-93A0043A6253"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]