CVE-2018-0190: cisco ios_xe Cross-site Scripting

Vulnerability summary

CVE-2018-0190 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in cisco ios_xe. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities.

Timeline

1. 28-03-2018
   PublishedVulnerability first disclosed.
2. 02-12-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.