PT-2018-5385 · Cisco · Cisco Small Business 300 Series Managed Switches+5

Published 2018-01-18 · Updated 2020-09-04 · CVE-2017-12307

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Small Business 300 Series Managed Switches (affected versions not specified) Cisco Small Business 500 Series Stackable Managed Switches (affected versions not specified) Cisco 350 Series Managed Switches (affected versions not specified) Cisco 350X Series Stackable Managed Switches (affected versions not specified) Cisco 550X Series Stackable Managed Switches (affected versions not specified) Cisco ESW2 Series Advanced Switches (affected versions not specified)

Description: A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The issue is due to insufficient input validation of parameters passed to the web server. An attacker could exploit this by convincing a user to follow a malicious link or by intercepting and injecting code into a user request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or access sensitive browser-based information.

Recommendations: For Cisco Small Business 300 Series Managed Switches, update the software to a version that includes the fix for the issue. For Cisco Small Business 500 Series Stackable Managed Switches, update the software to a version that includes the fix for the issue. For Cisco 350 Series Managed Switches, update the software to a version that includes the fix for the issue. For Cisco 350X Series Stackable Managed Switches, update the software to a version that includes the fix for the issue. For Cisco 550X Series Stackable Managed Switches, update the software to a version that includes the fix for the issue. For Cisco ESW2 Series Advanced Switches, update the software to a version that includes the fix for the issue. As a temporary workaround, consider restricting access to the web interface of the affected system until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-12307

Affected Products

Cisco 350 Series Managed Switches

Cisco 350X Series Stackable Managed Switches

Cisco 550X Series Stackable Managed Switches

Cisco Esw2 Series Advanced Switches

Cisco Small Business 300 Series Managed Switches

Cisco Small Business 500 Series Stackable Managed Switches

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12307 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-300-500-smb1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12307 · Vendor Advisory
• http://securityfocus.com/bid/102718 · Note