PT-2017-1798 · Cisco · Cisco Prime Infrastructure

Publicado 2017-04-07 · Atualizado 2019-07-29 · CVE-2017-3848

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure version 2.2(2) Cisco Prime Infrastructure versions prior to 3.1(0.0)

Description A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. The issue exists due to insufficient protection of the web page structure.

Recommendations For version 2.2(2), update to version 3.1(0.0) or later to resolve the issue. For versions prior to 3.1(0.0), update to version 3.1(0.0) or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP web-based management interface until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2017-00954

CVE-2017-3848

Produtos afetados

Cisco Prime Infrastructure

Referências · 6

• http://securitytracker.com/id/1037947 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3848 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3848 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-cpi · Aviso do Fabricante
• http://securityfocus.com/bid/96505 · Nota
• https://bdu.fstec.ru/vul/2017-00954 · Nota de Segurança