XSS in Cisco Telepresence Tc Software

CVE-2015-0696

Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.015 (72.2th percentile) — read the EPSS interpretation.

Affected products

Cisco Telepresence_tc_software — versions 6.0.0, 6.0.0-cucm, 6.0.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)