Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload.
References
| Link | Resource |
|---|---|
| https://networks.unify.com/security/advisories/OBSO-2002-01.pdf | Vendor Advisory |
| https://unify.com/en/support/security-advisories | Vendor Advisory |
| https://networks.unify.com/security/advisories/OBSO-2002-01.pdf | Vendor Advisory |
| https://unify.com/en/support/security-advisories | Vendor Advisory |
Configurations
History
21 Nov 2024, 04:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://networks.unify.com/security/advisories/OBSO-2002-01.pdf - Vendor Advisory | |
| References | () https://unify.com/en/support/security-advisories - Vendor Advisory |
Information
Published : 2020-02-21 16:15
Updated : 2024-11-21 04:35
NVD link : CVE-2019-19865
Mitre link : CVE-2019-19865
CVE.ORG link : CVE-2019-19865
JSON object : View
Products Affected
atos
- unify_openscape_uc_web_client
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')