CVE-2007-5581
published 2007-11-08CVE-2007-5581: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to…
PriorityP415medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.22%
65.6th percentile
Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | unified_meetingplace | <= 5.4 | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
| cisco | unified_meetingplace | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Unified MeetingPlace XSS Vulnerability
vendor_cisco·2007-11-07·CVSS 4.3
[MEDIUM] Cisco Unified MeetingPlace XSS Vulnerability
Cisco Unified MeetingPlace XSS Vulnerability
This is the Cisco PSIRT response to an issue that was discovered and reported to Cisco by Joren McReynolds regarding a cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing.
The original report is available at the following link: http://secunia.com/advisories/26462/
We greatly appreciate the opportunity to work with researchers on security vulnerabilities and welcome the opportunity to review and assist in product reports.
This vulnerability is documented in Cisco bug ID CSCsk17122 ( registered customers only) .
Since Cisco published this response, other variations of XSS associated with FirstName or LastName parameters have been discovered. These additional XSS vulnerabilities are documented in Cisco bug ID CS
Cisco
Cisco Unified MeetingPlace Login Screen Cross-Site Scripting Vulnerability
vendor_cisco·2007-11-07·CVSS 4.3
CVE-2007-5581 [MEDIUM] CWE-79 Cisco Unified MeetingPlace Login Screen Cross-Site Scripting Vulnerability
Cisco Unified MeetingPlace Login Screen Cross-Site Scripting Vulnerability
Cisco Unified MeetingPlace versions 5.3.235.0 and prior, 5.4, and 6.0 contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.
This vulnerability is due to insufficient filtering of parameters passed to the Login form of Cisco Unified MeetingPlace. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to follow a URL containing malicious parameters. When followed, the link could cause the affected site to return attacker-supplied script code to the affected user within the security context of the affected site. This could allow the attacker to execute arbitrary script code or HTML within a user's browser session. This c
GHSA
GHSA-36mh-7278-8282: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx
ghsa_unreviewed·2022-05-01
CVE-2007-5581 [MEDIUM] CWE-79 GHSA-36mh-7278-8282: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx
Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/26462http://securitytracker.com/id?1018904http://www.cisco.com/warp/public/707/cisco-sr-20071107-mp.shtmlhttp://www.securityfocus.com/bid/26364http://www.vupen.com/english/advisories/2007/3772https://exchange.xforce.ibmcloud.com/vulnerabilities/38298http://secunia.com/advisories/26462http://securitytracker.com/id?1018904http://www.cisco.com/warp/public/707/cisco-sr-20071107-mp.shtmlhttp://www.securityfocus.com/bid/26364http://www.vupen.com/english/advisories/2007/3772https://exchange.xforce.ibmcloud.com/vulnerabilities/38298
2007-11-08
Published