Vulnerabilities > CVE-2007-2832 - Cross-Site Scripting vulnerability in Cisco CallManager Search Form

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

cisco

exploit available

NVD

Published: 2007-05-24

Updated: 2017-07-29

Summary

Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to CCMAdmin/serverlist.asp (aka the search-form) and possibly other unspecified vectors.

Vulnerable Configurations

Part	Description	Count
Hardware	Cisco Cisco Call Manager 3.3 Cisco Call Manager 3.3\(3\) Cisco Call Manager 3.3\(3\)Es61 Cisco Call Manager 3.3\(4\)Es25 Cisco Call Manager 3.3\(5\) Cisco Call Manager 3.3\(5\)Es30 Cisco Call Manager 3.3\(5\)Sr1 Cisco Call Manager 3.3\(5\)Sr2 Cisco Call Manager 4.1 Cisco Call Manager 4.1\(2\)Es33 Cisco Call Manager 4.1\(2\)Es55 Cisco Call Manager 4.1\(3\)Es07 Cisco Call Manager 4.1\(3\)Es32 Cisco Call Manager 4.1\(3\)Sr1 Cisco Call Manager 4.1\(3\)Sr2 Cisco Call Manager 4.1\(3\)Sr3 Cisco Call Manager 4.2\(3\) Cisco Call Manager 4.2\(3\)Sr1 Cisco Call Manager 4.3\(1\)	19

Exploit-Db

description	Cisco CallManager 4.1 Search Form Cross Site Scripting Vulnerability. CVE-2007-2832. Webapps exploit for asp platform
id	EDB-ID:30077
last seen	2016-02-03
modified	2007-05-23
published	2007-05-23
reporter	Marc Ruef
source	https://www.exploit-db.com/download/30077/
title	Cisco CallManager 4.1 - Search Form Cross-Site Scripting Vulnerability

Summary

Vulnerable Configurations

Exploit-Db

References