1. Home
  2. CVE Database
  3. CVE-2019-16008
MEDIUM · 5.4

CVE-2019-16008

A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) att...

Vulnerability Description

A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based GUI of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
CiscoIp Phone 6841 Firmware< 11.3\(1\)
CiscoIp Phone 6841-
CiscoIp Phone 6851 Firmware< 11.3\(1\)
CiscoIp Phone 6851-
CiscoIp Phone 6825 Firmware< 11.3\(1\)
CiscoIp Phone 6825-
CiscoIp Phone 6861 Firmware< 11.3\(1\)
CiscoIp Phone 6861-
CiscoIp Phone 6871 Firmware< 11.3\(1\)
CiscoIp Phone 6871-
CiscoIp Phone 6821 Firmware< 11.3\(1\)
CiscoIp Phone 6821-
CiscoIp Phone 7811 Firmware< 11.3\(1\)
CiscoIp Phone 7811-
CiscoIp Phone 7821 Firmware< 11.3\(1\)
CiscoIp Phone 7821-
CiscoIp Phone 7832 Firmware< 11.3\(1\)
CiscoIp Phone 7832-
CiscoIp Phone 7841 Firmware< 11.3\(1\)
CiscoIp Phone 7841-

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2019-16008?

CVE-2019-16008 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) att...

How severe is CVE-2019-16008?

CVE-2019-16008 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-16008?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ip Phone 6841 Firmware, Cisco Ip Phone 6841, Cisco Ip Phone 6851 Firmware, Cisco Ip Phone 6851, Cisco Ip Phone 6825 Firmware.