CVE-2007-4284 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified MeetingPlace Web Conferencing (MP) 5.3.235.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) Success Template (STPL) and (2) Failure Template (FTPL) parameters, which are not properly handled in an error message.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Meetingplace Web Confrencing

Configuration 1 [-]

cpe:2.3:a:cisco:meetingplace_web_confrencing:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html
http://secunia.com/advisories/26376
http://securityreason.com/securityalert/2990
http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html
http://www.securityfocus.com/archive/1/475840/100/0/threaded
http://www.securityfocus.com/archive/1/475845/100/0/threaded
http://www.securityfocus.com/bid/25237
http://www.securitytracker.com/id?1018537
http://www.vupen.com/english/advisories/2007/2815
https://exchange.xforce.ibmcloud.com/vulnerabilities/35871

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-08-09T21:00:00

Updated: 2024-08-07T14:53:54.236Z

Reserved: 2007-08-09T00:00:00

Link: CVE-2007-4284

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-08-09T21:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4284

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-08-08T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified MeetingPlace Web Conferencing (MP) 5.3.235.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) Success Template (STPL) and (2) Failure Template (FTPL) parameters, which are not properly handled in an error message."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html"}, {"name": "1018537", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1018537"}, {"name": "cisco-meetingplace-unspecified-xss(35871)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35871"}, {"name": "26376", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26376"}, {"name": "20070808 Cisco Unified MeetingPlace XSS Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html"}, {"name": "ADV-2007-2815", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/2815"}, {"name": "25237", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25237"}, {"name": "20070808 RE: XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475845/100/0/threaded"}, {"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/475840/100/0/threaded"}, {"name": "2990", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2990"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2007-4284", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified MeetingPlace Web Conferencing (MP) 5.3.235.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) Success Template (STPL) and (2) Failure Template (FTPL) parameters, which are not properly handled in an error message."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html"}, {"name": "1018537", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1018537"}, {"name": "cisco-meetingplace-unspecified-xss(35871)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35871"}, {"name": "26376", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26376"}, {"name": "20070808 Cisco Unified MeetingPlace XSS Vulnerability", "refsource": "CISCO", "url": "http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html"}, {"name": "ADV-2007-2815", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/2815"}, {"name": "25237", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25237"}, {"name": "20070808 RE: XSS vulnerability in Cisco MeetingPlace", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475845/100/0/threaded"}, {"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/475840/100/0/threaded"}, {"name": "2990", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2990"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:53:54.236Z"}, "title": "CVE Program Container", "references": [{"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html"}, {"name": "1018537", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1018537"}, {"name": "cisco-meetingplace-unspecified-xss(35871)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35871"}, {"name": "26376", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26376"}, {"name": "20070808 Cisco Unified MeetingPlace XSS Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html"}, {"name": "ADV-2007-2815", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/2815"}, {"name": "25237", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25237"}, {"name": "20070808 RE: XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475845/100/0/threaded"}, {"name": "20070808 XSS vulnerability in Cisco MeetingPlace", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/475840/100/0/threaded"}, {"name": "2990", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2990"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4284", "datePublished": "2007-08-09T21:00:00", "dateReserved": "2007-08-09T00:00:00", "dateUpdated": "2024-08-07T14:53:54.236Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:meetingplace_web_confrencing:*:*:*:*:*:*:*:*", "matchCriteriaId": "694F296D-B892-4893-8D41-CF2AE3B37E76", "versionEndIncluding": "5.3\\(235\\)", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified MeetingPlace Web Conferencing (MP) 5.3.235.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) Success Template (STPL) and (2) Failure Template (FTPL) parameters, which are not properly handled in an error message."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Cisco Unified MeetingPlace Web Conferencing (MP) 5.3.235.0 y versiones anteriores permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante los par\u00e1metros (1) Success Template (STPL) y (2) Failure Template (FTPL), que no son gestionados apropiadamente en un mensaje de error."}], "id": "CVE-2007-4284", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-08-09T21:17:00.000", "references": [{"source": "[email protected]", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/26376"}, {"source": "[email protected]", "url": "http://securityreason.com/securityalert/2990"}, {"source": "[email protected]", "url": "http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/475840/100/0/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/475845/100/0/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/bid/25237"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id?1018537"}, {"source": "[email protected]", "url": "http://www.vupen.com/english/advisories/2007/2815"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35871"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065134.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/26376"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2990"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.cisco.com/en/US/products/products_security_response09186a008089969e.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475840/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/475845/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/25237"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1018537"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/2815"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35871"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}