PT-2020-1882 · Cisco · Cisco Dna Center
Benoit Malaboeuf
+1
·
Published
2020-02-05
·
Updated
2025-07-23
·
CVE-2019-15253
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco DNA Center Software versions prior to 1.3.0.6
Cisco DNA Center Software versions prior to 1.3.1.4
Description
The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs administrator credentials.
Recommendations
For Cisco DNA Center Software versions prior to 1.3.0.6, update to version 1.3.0.6 or later.
For Cisco DNA Center Software versions prior to 1.3.1.4, update to version 1.3.1.4 or later.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface with administrator credentials until the issue is resolved.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Dna Center