CVE:CVE-2007-4633
CNNVD:CNNVD-200708-503
Cisco CallManager 和 Unified Communications Manager (CUCM) 3.3(5)sr2b版本之前的版本, 4.1(3)sr5版本之前的4.1版本, 4.2(3)sr2版本之前的4.2版本, 以及4.3版本之前的版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助对(1) user 或 (2) 管理登录页的lang自变量，又称CSCsi10728，注入任意web脚本或HTML。
solution:Upgrade cisco unified_communications_manager to a higher version than 4.2.3sr2,4.2.3sr2b,and avoid the version 4.2.3sr2,4.2.3sr2b; Upgrade cisco call_manager to a higher version than 3.3(5sr1,3.3(5sr2,3.3(5sr2a,4.1,4.1(3sr1,4.1(3sr2,4.1(3sr3,4.1(3sr4,4.2,4.2(1,4.2(2,4.2(3,4.2(3sr1,4.2(3sr2,4.3,4.3(1,4.3(1sr1,and avoid the version 3.3(5)sr1,3.3(5)sr2,3.3(5)sr2a,4.1,4.1(3)sr1,4.1(3)sr2,4.1(3)sr3,4.1(3)sr4,4.2,4.2(1),4.2(2),4.2(3),4.2(3)sr1,4.2(3)sr2,4.3,4.3(1),4.3(1)sr1