Description
While attempts have been made to restrict the ability to perform Cross-Site Scripting attacks against Unity, it is possible to store the script to be executed in the data store in order to cause it to be executed when the next administrator logs in and accesses a page relying on this stored information.
Recommendations
Cisco has acknowledged the issue and is working on patches to correct it. More details could be found at http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Cisco customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.