PT-2015-4738 · Cisco · Cisco Prime Lan Management Solution+2

Published 2015-02-27 · Updated 2015-11-02 · CVE-2015-0594

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime LAN Management Solution (LMS) (affected versions not specified) Cisco Security Manager (affected versions not specified) Cisco Common Services (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the help pages of Cisco Common Services, which is used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Recommendations For Cisco Prime LAN Management Solution (LMS), update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. For Cisco Security Manager, update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. For Cisco Common Services, update to a version that includes the fix for Bug IDs CSCuq54654 and CSCun18263. As a temporary workaround, consider restricting access to the help pages in Cisco Common Services to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-0594

Affected Products

Cisco Common Services

Cisco Prime Lan Management Solution

Cisco Security Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-0594 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0594 · Vendor Advisory
• http://securitytracker.com/id/1031813 · Note
• http://securityfocus.com/bid/72793 · Note
• http://securitytracker.com/id/1031814 · Note