Unscored severity · published May 24, 2007
CVE-2007-2832
Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVSS
6.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the web application firewall in Cisco CallManager before 3.3(5)sr3, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to CCMAdmin/serverlist.asp (aka the search-form) and possibly other unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Call Manager · Cisco
3.3; 3.3(3); 3.3(3)es61; 3.3(4)es25; 3.3(5); 3.3(5)es30; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2832
Exploit
http://marc.info/?l=full-disclosure&m=117993122727006&w=2
Patch
http://secunia.com/advisories/25377
www.cisco.com
http://www.cisco.com/en/US/products/products_security_response09186a0080849272.html
www.osvdb.org
http://www.osvdb.org/35337
www.scip.ch
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2977
www.securityfocus.com
http://www.securityfocus.com/bid/24119
More from Call Manager
7.5
CVE-2004-0079
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake…
–
CVE-2007-5468
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest…
–
CVE-2007-4634
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before…
–
CVE-2007-4633
Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2,…
–
CVE-2007-1467
Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS), VPN Client, Unified Personal…