Read the docs
TI-2018-00345 Aliases CVE-2018-0386GHSA-4pww-h464-j283

Cross-site scripting in Cisco Unified Communications Domain Manager Software

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01823 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoUnified Communications Domain Manager Softwareall versions—No fix listedCNA
  • Unified Communications Domain Manager Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*11.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_communications_domain_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableCisco
  • cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:* Versions 11.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_communications_domain_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0386
  2. 2026-10-03 Alias added: GHSA-4pww-h464-j283

References

Advisory 1

  • TI-2017-07185 Deserialization of untrusted data in Apache Struts KEVCVSS 3.1HIGH 8.1
  • TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
  • TI-2019-01532 Cisco Unified Communications Domain Manager Restricted Shell Escape Vulnerability CVSS 3.0HIGH 7.8
  • TI-2015-00690 Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for… CVSS 2.0MEDIUM 6.8
  • TI-2015-00698 The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and… CVSS 2.0MEDIUM 6.5
  • TI-2014-01672 Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution (HCS)… CVSS 2.0MEDIUM 5.0
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences