Cisco Prime Infrastructure CVE-2017-6782 HTML Injection Vulnerability

Bugtraq ID:	100366
Class:	Input Validation Error
CVE:	CVE-2017-6782
Remote:	Yes
Local:	No
Published:	Aug 16 2017 12:00AM
Updated:	Aug 16 2017 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Prime Infrastructure 3.2(0.0)
Not Vulnerable:

Cisco Prime Infrastructure CVE-2017-6782 HTML Injection Vulnerability

Cisco Prime Infrastructure is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

The issue is being tracked by Cisco Bug ID CSCve47074.

Cisco Prime Infrastructure version 3.2(0.0) is vulnerable.

Cisco Prime Infrastructure CVE-2017-6782 HTML Injection Vulnerability

An attacker can exploit this issue using readily available tools.

Cisco Prime Infrastructure CVE-2017-6782 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Prime Infrastructure CVE-2017-6782 HTML Injection Vulnerability

References:

• Cisco Prime Infrastructure Homepage (Cisco)
  
• cisco-sa-20170816-cpi:Cisco Prime Infrastructure HTML Injection Vulnerability (Cisco)