PT-2018-1817 · Cisco · Cisco Wireless Lan Controller+1

Published 2018-08-15 · Updated 2023-02-03 · CVE-2018-0388

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller Software versions prior to the fixed version

Description The issue is related to insufficient protection of the web interface structure, allowing an attacker to inject arbitrary code into a web page using a specially crafted link. This vulnerability could enable a remote attacker to conduct a cross-site scripting (XSS) attack against users of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Recommendations For versions prior to the fixed version, update to the latest version of Cisco Wireless LAN Controller Software to resolve the issue. As a temporary workaround, consider restricting access to the web-based interface to minimize the risk of exploitation. Avoid using the web-based interface until the issue is resolved, if possible.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01417

CVE-2018-0388

Affected Products

Cisco Wireless Lan Controller

Cisco Wls

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-0388 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlan-xss · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01417 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0388 · Vendor Advisory
• http://securitytracker.com/id/1041927 · Note
• https://t.me/cvenotify/43511 · Telegram Post
• https://t.me/cvenotify/13361 · Telegram Post
• http://securityfocus.com/bid/105665 · Note