PT-2015-4738 · Cisco · Cisco Prime Lan Management Solution+2

Publicado 2015-02-27 · Atualizado 2015-11-02 · CVE-2015-0594

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime LAN Management Solution (LMS) (affected versions not specified) Cisco Security Manager (affected versions not specified) Cisco Common Services (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the help pages of Cisco Common Services, which is used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Recommendations For Cisco Prime LAN Management Solution (LMS), update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. For Cisco Security Manager, update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. For Cisco Common Services, update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. As a temporary workaround, consider restricting access to the help pages in Cisco Common Services to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-0594

Produtos afetados

Cisco Common Services

Cisco Prime Lan Management Solution

Cisco Security Manager

Referências · 5

• http://securitytracker.com/id/1031813 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0594 · Nota de Segurança
• http://securityfocus.com/bid/72793 · Nota
• http://securitytracker.com/id/1031814 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0594 · Aviso do Fabricante