PT-2019-1305 · Cisco · Cisco Prime Infrastructure

Published 2019-01-23 · Updated 2019-10-09 · CVE-2019-1643

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure versions (affected versions not specified)

Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, allowing an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. This could enable the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. The exploitation may occur when a user of the interface clicks a maliciously crafted link.

Recommendations For all affected versions of Cisco Prime Infrastructure, consider implementing input validation mechanisms to prevent malicious input from being processed by the web-based management interface. As a temporary workaround, restrict access to the web-based management interface to minimize the risk of exploitation. Avoid clicking on suspicious or unfamiliar links within the interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-00537

CVE-2019-1643

Affected Products

Cisco Prime Infrastructure

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-cpi-xss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00537 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1643 · Security Note
• http://securityfocus.com/bid/106702 · Note