Cisco DNA Center Access Contract CVE-2019-1707 HTML Injection Vulnerability
BID:107315
CVE-2019-1707 |Info
Cisco DNA Center Access Contract CVE-2019-1707 HTML Injection Vulnerability
| Bugtraq ID: | 107315 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-1707 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 06 2019 12:00AM |
| Updated: | Mar 06 2019 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Cisco DNA Center 0 |
| Not Vulnerable: | |
Discussion
Cisco DNA Center Access Contract CVE-2019-1707 HTML Injection Vulnerability
Cisco DNA Center Access Contract is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCvk51466.
Cisco DNA Center Access Contract is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
This issue is being tracked by Cisco Bug ID CSCvk51466.
Exploit / POC
Cisco DNA Center Access Contract CVE-2019-1707 HTML Injection Vulnerability
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.
References
Cisco DNA Center Access Contract CVE-2019-1707 HTML Injection Vulnerability
References:
References: