Unscored severity · published Mar 16, 2007
CVE-2007-1467
Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage, Unified Videoconferencing 35xx products, Unified Videoconferencing Manager, WAN Manager, Security Device Manager, Network Analysis Module (NAM), CiscoWorks and related products, Wireless LAN Solution Engine (WLSE), 2006 Wireless LAN Controllers (WLC), and Wireless Control System (WCS) allow remote attackers to inject arbitrary web script or HTML via the text field of the search form.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Acs Solution Engine · Cisco
4.1; 4.1 · source: NVD
CM
Call Manager · Cisco
All versions, or not specified · source: NVD
CI
Ciscoworks · Cisco
All versions, or not specified · source: NVD
IC
IP Communicator · Cisco
All versions, or not specified · source: NVD
ME
Meetingplace · Cisco
All versions, or not specified · source: NVD
NA
Network Analysis Module · Cisco
All versions, or not specified · source: NVD
SD
Security Device Manager · Cisco
All versions, or not specified · source: NVD
UM
Unified Meetingplace · Cisco
All versions, or not specified · source: NVD
UM
Unified Meetingplace Express · Cisco
All versions, or not specified · source: NVD
UP
Unified Personal Communicator · Cisco
All versions, or not specified · source: NVD
UV
Unified Video Advantage · Cisco
All versions, or not specified · source: NVD
UV
Unified Videoconferencing · Cisco
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1467
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1467
secunia.com
http://secunia.com/advisories/24499
securityreason.com
http://securityreason.com/securityalert/2437
Vendor Advisory
http://www.cisco.com/en/US/products/products_security_response09186a0080803fe4.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/462932/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/462944/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/22982
More from Acs Solution Engine
–
CVE-2008-0532
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution…
–
CVE-2008-0533
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for…