CVE:CVE-2009-2048
CNNVD:CNNVD-200907-263
Cisco Unified Contact Center Express(CCX)是Cisco Unified Communications系统的组件之一，在管理客户联络时，能够享受到融合式思科IP电话架构的所有优点。 Unified CCX服务器的客户响应解决方案(CRS)和Cisco Unified IP交互语音响应(Cisco Unified IP IVR)产品中的管理页面存在目录遍历和脚本注入漏洞。脚本注入漏洞可能允许通过认证的用户向Unified CCX数据库中注入JavaScript，所存储的脚本会在下一个认证用户的浏览器中执行 。
solution:Upgrade cisco crs to a higher version than 3.5,4.0,4.1,4.5,5.0,6.0,7.0,and avoid the version 3.5,4.0,4.1,4.5,5.0,6.0,7.0; Upgrade cisco customer_response_applications to a higher version than 3.5,and avoid the version 3.5; Upgrade cisco ip_qm to a higher version than 3.5,and avoid the version 3.5; Upgrade cisco unified_ccx to a higher version than 3.5,4.0(1,4.0(3,4.0(4,4.0(5,4.0(5a,4.5(1,4.5(2,5.0(1,6.0(1,7.0(1,and avoid the version 3.5,4.0(1),4.0(3),4.0(4),4.0(5),4.0(5a),4.5(1),4.5(2),5.0(1),6.0(1),7.0(1); Upgrade cisco unified_ip_contact_center_express to a higher version than 3.0,5.0(1,6.0(1,7.0,and avoid the version 3.0,5.0(1),6.0(1),7.0; Upgrade cisco unified_ip_ivr to a higher version than 3.0,3.1,4.0,4.1,4.5,5.0,6.0,7.0,7.0(1,and avoid the version 3.0,3.1,4.0,4.1,4.5,5.0,6.0,7.0,7.0(1)