PT-2013-6084 · Cisco · Cisco Wireless Lan Controller+1

Publicado 2013-11-22 · Atualizado 2013-11-25 · CVE-2013-6698

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) (affected versions not specified)

Description The issue is related to a cross-frame scripting (XFS) problem, where the web interface does not properly restrict the use of IFRAME elements. This makes it easier for remote attackers to conduct clickjacking attacks and other unspecified attacks via a crafted web site. An attacker could exploit this by directing a user to an attacker-controlled web page containing a malicious HTML iframe, potentially allowing clickjacking or other client-side browser attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6698

Produtos afetados

Cisco Wireless Lan Controller

Cisco Wls

Referências · 4

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6698 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6698 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131122-CVE-2013-6698 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6698 · Nota de Segurança