PT-2016-2782 · Cisco · Cisco Ios+1

Publicado 2016-09-14 · Atualizado 2017-07-30 · CVE-2016-6404

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.5(2)T and earlier

Description A cross-site scripting (XSS) issue exists in the web framework of Cisco IOx Local Manager, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code, potentially allowing the attacker to execute arbitrary code in the context of the affected site or access sensitive browser-based information.

Recommendations For Cisco IOS version 15.5(2)T, update to a fixed version to resolve the issue. At the moment, there is no information about additional mitigation measures for other affected versions.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2016-02185

CVE-2016-6404

Produtos afetados

Cisco Ios

Cisco Iox Local Manager

Referências · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ios · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-02185 · Nota de Segurança
• http://securityfocus.com/bid/92963 · Nota
• https://osv.dev/vulnerability/CVE-2016-6404 · Aviso do Fabricante
• http://securitytracker.com/id/1036834 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6404 · Nota de Segurança