Cross-site scripting in Cisco Jabber
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf50378, CSCvg56018.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Jabber | Cisco Jabber | — | No fix listed | CNA |
- Cisco Jabber Vendor— Affected Cisco Jabber Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:jabber:-:*:*:*:*:android:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:-:*:*:*:*:iphone_os:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:-:*:*:*:*:mac:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:10.5\(2\):*:*:*:*:windows:*:* | 10.5(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:11.9\(1\):*:*:*:*:windows:*:* | 11.9(1) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:jabber:-:*:*:*:*:android:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:-:*:*:*:*:iphone_os:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:-:*:*:*:*:mac:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:10.5\(2\):*:*:*:*:windows:*:* Versions 10.5(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:11.9\(1\):*:*:*:*:windows:*:* Versions 11.9(1) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12356
- 2026-10-03 Alias added: GHSA-rxq6-w25h-3xh7
References
More Cisco Jabber vulnerabilities
- TI-2020-03041 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
- TI-2020-15937 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2020-02979 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability CVSS 3.1HIGH 8.8
- TI-2021-01198 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2021-01138 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2020-16496 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
Sources
- CVE-2017-12356 · CVE Program
- CVE-2017-12356 · NVD
- FIRST EPSS
- GHSA-rxq6-w25h-3xh7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences