The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe
within a web page, which in turn could lead to a clickjacking attack. Protection mechanisms should be used to prevent this type of attack.
The vulnerability is due to a lack of proper input sanitization of iframe
data within the HTTP requests sent to the device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iframe
data. An exploit could allow the attacker to perform a clickjacking or phishing attack where the user is tricked into clicking on a malicious link. Protection mechanisms should be used to prevent this type of attack.
Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.
This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-ucm