Some vulnerabilities have been reported in Cisco Unified MeetingPlace, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to bypass certain security restrictions.

1) A vulnerability is caused due to an unspecified error, which can be exploited to bypass the authentication mechanism via a specially crafted URL.

2) Input passed to the "email" field of the user profile is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when the malicious account detail or meeting details page is viewed.

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
National Australia Bank's Security Assurance team.

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.cisco.com/warp/public/707/cisco-sa-20090225-mtgplace.shtml
2) http://www.cisco.com/warp/public/707/cisco-sr-20090226-mtgplace.shtml

Deep Links
Links available in Customer Area