PT-2018-8657 · Cisco · Cisco Ios Xe

Publicado 2018-03-28 · Atualizado 2019-10-09 · CVE-2018-0186

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is related to multiple vulnerabilities in the web-based user interface of Cisco IOS XE Software, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerabilities are due to insufficient input validation of certain parameters passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user to access a malicious link or by intercepting a user request and injecting malicious code. A successful exploit could allow the attacker to execute arbitrary script code or access sensitive browser-based information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-0186

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-0186 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0186 · Aviso do Fabricante
• http://securityfocus.com/bid/103551 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss · Aviso do Fabricante