PT-2018-8659 · Cisco · Cisco Ios Xe

Published 2018-03-28 · Updated 2019-10-09 · CVE-2018-0190

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is related to multiple vulnerabilities in the web-based user interface of Cisco IOS XE Software, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerabilities are due to insufficient input validation of certain parameters passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user to access a malicious link or by intercepting a user request and injecting malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or access sensitive browser-based information on the user's system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-0190

Affected Products

Cisco Ios Xe

References · 4

• https://osv.dev/vulnerability/CVE-2018-0190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0190 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss · Vendor Advisory
• http://securityfocus.com/bid/103551 · Note