PT-2019-3334 · Cisco · Cisco Ios+1

Nishith Sinha · Published 2019-09-25 · Updated 2019-10-09 · CVE-2019-12668

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS and Cisco IOS XE Software (affected versions not specified)

Description The issue is related to insufficient input validation of the banner parameter in the web framework code, allowing an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface. An attacker could exploit this by crafting a banner parameter and saving it, then convincing a user to access a malicious link or intercepting a user request and injecting malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or access sensitive browser-based information.

Recommendations For Cisco IOS and Cisco IOS XE Software, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. As a temporary workaround, consider restricting access to the web interface of the affected software to minimize the risk of exploitation. Avoid using the banner parameter in the affected web interface until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-03441

CVE-2019-12668

Affected Products

Cisco Ios

Cisco Ios Xe

References · 4

• https://bdu.fstec.ru/vul/2019-03441 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-12668 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12668 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sbxss · Vendor Advisory