PT-2019-2067 · Cisco · Cisco Application Policy Infrastructure Controller
Published
2019-05-01
·
Updated
2019-05-07
·
CVE-2019-1838
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Application Policy Infrastructure Controller (APIC) versions prior to 14.1(1i)
Description
A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The issue is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.
Recommendations
For versions prior to 14.1(1i), update to software version 14.1(1i) to fix the vulnerability. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface with untrusted input until the issue is resolved.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Application Policy Infrastructure Controller