CVE-2018-0355

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCvg19761.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20CWE-1021

Affected software

No affected versions have been published.

Timeline

Published
Jun 7, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-03566.1A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) CVE-2018-03576.1A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) CVE-2018-03587.5A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthenticCVE-2018-03595.5A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could CVE-2018-03605.5ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehCVE-2018-03613.3ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.CVE-2018-03624.3A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) ECVE-2018-03638.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could alCVE-2018-03648.8A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote CVE-2018-03658.8A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker tCVE-2018-03666.1A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker CVE-2018-03675.4A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker
CVE-2018-0355: Medium severity, CVSS 6.1 | Vulnix