PT-2010-4459 · Cisco · Cisco Wireless Control System

Publicado 2010-08-09 · Atualizado 2018-10-10 · CVE-2010-2986

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless Control System (WCS) versions prior to 6.0(194.0) Cisco Wireless Control System (WCS) versions 7.x prior to 7.0.164

Description A cross-site scripting (XSS) issue exists in the search feature of the web interface, allowing remote attackers to inject arbitrary web script or HTML via the searchText parameter.

Recommendations For versions prior to 6.0(194.0), update to version 6.0(194.0) or later. For versions 7.x prior to 7.0.164, update to version 7.0.164 or later. As a temporary workaround, consider restricting access to the web interface or avoiding the use of the searchText parameter in the vulnerable webacs/QuickSearchAction.do endpoint until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2986

Produtos afetados

Cisco Wireless Control System

Referências · 6

• 🔥 http://tomneaves.com/Cisco_Wireless_Control_System_XSS.txt · Exploit
• http://securityfocus.com/archive/1/512878/100/0/threaded · Nota
• http://securityfocus.com/bid/42216 · Nota
• http://secunia.com/advisories/40827 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2986 · Nota de Segurança
• http://cisco.com/en/US/docs/wireless/controller/release/notes/crn7.0.html · Nota