PT-2018-8659 · Cisco · Cisco Ios Xe

Publicado 2018-03-28 · Atualizado 2019-10-09 · CVE-2018-0190

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is related to multiple vulnerabilities in the web-based user interface of Cisco IOS XE Software, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerabilities are due to insufficient input validation of certain parameters passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user to access a malicious link or by intercepting a user request and injecting malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or access sensitive browser-based information on the user's system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-0190

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-0190 · Aviso do Fabricante
• http://securityfocus.com/bid/103551 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0190 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss · Aviso do Fabricante