PT-2013-6084 · Cisco · Cisco Wireless Lan Controller+1

Published 2013-11-22 · Updated 2013-11-25 · CVE-2013-6698

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller (WLC) (affected versions not specified)

Description The issue is related to a cross-frame scripting (XFS) problem, where the web interface does not properly restrict the use of IFRAME elements. This makes it easier for remote attackers to conduct clickjacking attacks and other unspecified attacks via a crafted web site. An attacker could exploit this by directing a user to an attacker-controlled web page containing a malicious HTML iframe, potentially allowing clickjacking or other client-side browser attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6698

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 4

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6698 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6698 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131122-CVE-2013-6698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6698 · Security Note