CVE-2011-2544 – Cisco TelePresence SOS-11-010 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2011-2544

Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF) attacks that change passwords or cause a denial of service, aka Bug ID CSCtq46488. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en la interfaz web de Cisco TelePresence System MXP Serie F9.1 y anteriores, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML a través de una Call ID modificada, como lo demuestran los ataques de falsificación de petición en sitios cruzados (CSRF) que cambian las contraseñas o provocan una denegación de servicio, también conocido como Bug ID CSCtq46488. Cisco TelePresensce Series suffers from client-side code execution, denial of service, cookie theft, loss of confidentiality, and impersonation vulnerabilities. • https://www.exploit-db.com/exploits/17871 http://secunia.com/advisories/46057 http://secunia.com/advisories/46109 http://securityreason.com/securityalert/8393 http://securitytracker.com/id?1026072 http://www.exploit-db.com/exploits/17871 http://www.securityfocus.com/archive/1/519698/100/0/threaded http://www.securityfocus.com/bid/49670 https://exchange.xforce.ibmcloud.com/vulnerabilities/69906 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •