A vulnerability in the web-based management interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user. This vulnerability is due to insufficient input validation of a parameter that is used by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary code in the context of the affected interface or access sensitive, browser-based information. If the targeted user has administrative privileges, the attacker may also be able to cause the affected device to reboot.
Refer to Cisco Security Advisory for the patch, upgrade, or suggested workaround information.