CVE-2014-3313

Cross-site scripting (XSS) vulnerability in the web user interface on Cisco Small Business SPA300 and SPA500 phones allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuo52582.

Score

CVSS 2.0 4.3 Medium

Status

Modified - psirt@cisco.com

Published

2014-07-09

Last modified

2024-08-06

Weaknesses

CWE-79

Affected products

• Spa901 1-line Ip Phone (Cisco)
• Spa922 1-line Ip Phone With 1-port Ethernet (Cisco)
• Spa941 4-line Ip Phone With 1-port Ethernet (Cisco)
• Spa942 4-line Ip Phone With 2-port Switch (Cisco)
• Spa962 6-line Ip Phone With 2-port Switch (Cisco)
• Spa 301 1 Line Ip Phone (Cisco)
• Spa 303 3 Line Ip Phone (Cisco)
• Spa 501g 8-line Ip Phone (Cisco)
• Spa 502g 1-line Ip Phone (Cisco)
• Spa 504g 4-line Ip Phone (Cisco)
• Spa 508g 8-line Ip Phone (Cisco)
• Spa 509g 12-line Ip Phone (Cisco)
• Spa 512g 1-line Ip Phone (Cisco)
• Spa 514g 4-line Ip Phone (Cisco)
• Spa 525g2 5-line Ip Phone (Cisco)
• Spa 525g 5-line Ip Phone (Cisco)

References

• http://secunia.com/advisories/59808
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3313
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34885
• http://www.securityfocus.com/bid/68464
• http://www.securitytracker.com/id/1030553
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94422