Cisco Firepower Management Center RSS Multiple Cross Site Scripting Vulnerabilities
BID:109047
Info
Cisco Firepower Management Center RSS Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 109047 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-1930 CVE-2019-1931 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2019 12:00AM |
| Updated: | Jul 03 2019 12:00AM |
| Credit: | Cisco. |
| Vulnerable: |
Cisco FirePOWER Management Center 6.5 Cisco FirePOWER Management Center 6.4 Cisco FirePOWER Management Center 6.3 Cisco FirePOWER Management Center 6.2.3 |
| Not Vulnerable: | |
Discussion
Cisco Firepower Management Center RSS Multiple Cross Site Scripting Vulnerabilities
Cisco Firepower Management Center is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
These issues are being tracked by Cisco Bug IDs CSCvo90805 and CSCvo92913.
Cisco Firepower Management Center is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
These issues are being tracked by Cisco Bug IDs CSCvo90805 and CSCvo92913.
Exploit / POC
Cisco Firepower Management Center RSS Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Cisco Firepower Management Center RSS Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.