Login Request a demo
Unscored severity · published Jun 21, 2006
CVE-2006-3109
Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to…
–
CVSS
13.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2) arbitrary parameters in ccmuser/logon.asp, aka bugid CSCsb68657.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Call Manager · Cisco
3.3; 3.3(3); 3.3(3)es61; 3.3(4)es25; 3.3(5); 3.3(5)es30; +15 more · source: NVD
Affected product
CM
Call Manager
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3109
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047015.html
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047019.html
secunia.com
http://secunia.com/advisories/20735
securityreason.com
http://securityreason.com/securityalert/1114
Exploit
http://securitytracker.com/id?1016328
Patch
http://www.cisco.com/en/US/products/sw/voicesw/ps556/tsd_products_security_response09186a00806c0846.html
More from Call Manager
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2007-5468
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest…
–
CVE-2007-4634
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVE-2007-4633
Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2,…
–
CVE-2007-2832
Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…