CVE-2019-12668

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software using the banner parameter. The vulnerability is due to insufficient input validation of the banner parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by crafting a banner parameter and saving it. The attacker could then convince a user of the web interface to access a malicious link or could intercept a user request for the affected web interface and inject malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information.

Published : 2019-09-25 21:15 Updated : 2019-10-09 23:46

3.5

CVSS Score More info

Score 3.5 / 10

Access vector NETWORK

A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed "remotely exploitable". An example of a network attack is an RPC buffer overflow.

Access complexity MEDIUM

The access conditions are somewhat specialized; the following are examples:

The attacking party is limited to a group of systems or users at some level of authorization, possibly untrusted.
Some information must be gathered before a successful attack can be launched.
The affected configuration is non-default, and is not commonly configured (e.g., a vulnerability present when a server performs user account authentication via a specific scheme, but not present for another authentication scheme).
The attack requires a small amount of social engineering that might occasionally fool cautious users (e.g., phishing attacks that modify a web browsers status bar to show a false link, having to be on someones buddy list before sending an IM exploit).

Authentication SINGLE_INSTANCE

The vulnerability requires an attacker to be logged into the system (such as at a command line or via a desktop session or web interface).

Confidentiality impact NONE

There is no impact to the confidentiality of the system.

Integrity impact PARTIAL

Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope.

Availability impact NONE

There is no impact to the availability of the system.

CPE (22)
Tree view

Vendor	Product	Version	URI
Cisco	Ios	15.2%282%29e	cpe:/o:cisco:ios:15.2%282%29e
Cisco	Ios	15.2%282%29ea	cpe:/o:cisco:ios:15.2%282%29ea
Cisco	Ios	15.2%283%29e	cpe:/o:cisco:ios:15.2%283%29e
Cisco	Ios	15.2%283%29ea	cpe:/o:cisco:ios:15.2%283%29ea
Cisco	Ios	15.2%284%29e	cpe:/o:cisco:ios:15.2%284%29e
Cisco	Ios	15.2%284%29ea	cpe:/o:cisco:ios:15.2%284%29ea
Cisco	Ios	15.2%284%29ec	cpe:/o:cisco:ios:15.2%284%29ec
Cisco	Ios	15.2%285%29e	cpe:/o:cisco:ios:15.2%285%29e
Cisco	Ios	15.2%285%29ea	cpe:/o:cisco:ios:15.2%285%29ea
Cisco	Ios	15.2%285%29ex	cpe:/o:cisco:ios:15.2%285%29ex
Cisco	Ios	15.2%286%29e	cpe:/o:cisco:ios:15.2%286%29e
Cisco	Ios	15.2%287%29e	cpe:/o:cisco:ios:15.2%287%29e
Cisco	Ios Xe	3.6e	cpe:/o:cisco:ios_xe:3.6e
Cisco	Ios Xe	3.7e	cpe:/o:cisco:ios_xe:3.7e
Cisco	Ios Xe	3.8e	cpe:/o:cisco:ios_xe:3.8e
Cisco	Ios Xe	3.9e	cpe:/o:cisco:ios_xe:3.9e
Cisco	Ios Xe	3.10e	cpe:/o:cisco:ios_xe:3.10e
Cisco	Ios Xe	16.1.1	cpe:/o:cisco:ios_xe:16.1.1
Cisco	Ios Xe	16.3.4	cpe:/o:cisco:ios_xe:16.3.4
Cisco	Ios Xe	16.4.2	cpe:/o:cisco:ios_xe:16.4.2
Cisco	Ios Xe	16.5.1	cpe:/o:cisco:ios_xe:16.5.1
Cisco	Ios Xe	16.5.1b	cpe:/o:cisco:ios_xe:16.5.1b

Cisco (2) Search CVE
1. Ios Xe (10) Search CVE
  1. 3.6e
  2. 3.7e
  3. 3.8e
  4. 3.9e
  5. 3.10e
  6. 16.1.1
  7. 16.3.4
  8. 16.4.2
  9. 16.5.1
  10. 16.5.1b
2. Ios (12) Search CVE
  1. 15.2%282%29e
  2. 15.2%282%29ea
  3. 15.2%283%29e
  4. 15.2%283%29ea
  5. 15.2%284%29e
  6. 15.2%284%29ea
  7. 15.2%284%29ec
  8. 15.2%285%29e
  9. 15.2%285%29ea
  10. 15.2%285%29ex
  11. 15.2%286%29e
  12. 15.2%287%29e

CWE

ID	Name	Description	Links
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.		CVE