Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
BID:34454
Info
Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
| Bugtraq ID: | 34454 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2009 12:00AM |
| Updated: | May 06 2009 08:06PM |
| Credit: | Usman Saeed, Xc0re Security Research Group |
| Vulnerable: |
Cisco Subscriber Edge Services Manager (SESM) 0 |
| Not Vulnerable: | |
Discussion
Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
Cisco Subscriber Edge Services Manager is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
We don't know which versions of Subscriber Edge Services Manager are affected. We will update this BID as more information emerges.
Cisco Subscriber Edge Services Manager is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
We don't know which versions of Subscriber Edge Services Manager are affected. We will update this BID as more information emerges.
Exploit / POC
Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Cisco Subscriber Edge Services Manager Cross Site Scripting And HTML Injection Vulnerabilities
References:
References:
- Cisco Subscriber Edge Services Manager Multiple Vulnerabilities (Usman Saeed , Xc0re Security Research Group)
- Subscriber Edge Services Manage Homepage (Cisco)