Technical impact
A reflected XSS flaw exists in Cisco Unity Connection’s web‑based management interface because user input is not properly sanitized. An attacker can craft a URL that, when clicked by an administrator or other privileged user, injects malicious JavaScript into the browser session. This allows the attacker to execute arbitrary script code with the same privileges as the victim, potentially stealing session cookies or other data visible to the browser. The weakness is a canonical input‑validation issue listed as CWE‑79.
Affected Systems
Cisco Unity Connection across all released versions, as no specific affected version list is provided in the advisory. All installations should be assessed for the vulnerable input handling paths.
Risk and Exploitability
The CVSS score of 6.1 indicates moderate severity when successful. Exploit probability is not presently recorded, and there is no report of large‑scale exploitation. Attack vectors are remote and unauthenticated: the attacker only needs to entice a user who has legitimate access to the management interface to click a malicious link. Full exploitation occurs in the victim’s browser, not on the server, so confidentiality or integrity impact is confined to the client session.
