CVE-2018-0328 json
A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, rem…
published 2018-05-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1151
- cvss
- 6.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvg89116.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
1.75% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- n/a Cisco Unified Communications Manager and Cisco Unified Presence
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-cucm-cup-xss
vendor-advisory
-
securitytracker.com
/id/1040929
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1040928
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/104200
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-0328
- NVD CVE-2018-0328
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.