PT-2015-2587 · Cisco · Cisco Secure Access Control Server

Publicado 2015-10-30 · Atualizado 2016-12-07 · CVE-2015-6349

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue exists due to insufficient protection of the web page structure in the Solution Engine component of the Cisco Secure Access Control System. This allows a remote attacker to execute arbitrary web or HTML code using a specially crafted URL. The vulnerability can be exploited to inject arbitrary web script or HTML via a crafted URL, which is a type of cross-site scripting (XSS) attack.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using specially crafted URLs that could exploit the vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11952

CVE-2015-6349

Produtos afetados

Cisco Secure Access Control Server

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss1 · Aviso do Fabricante
• http://securitytracker.com/id/1033968 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6349 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11952 · Nota de Segurança