Cisco FireSIGHT System Software Cross Site Scripting and HTML-injection Vulnerabilities

Bugtraq ID:	75003
Class:	Input Validation Error
CVE:	CVE-2015-0766
Remote:	Yes
Local:	No
Published:	Jun 03 2015 12:00AM
Updated:	Jun 03 2015 12:00AM
Credit:	Cisco
Vulnerable:	Cisco FireSIGHT System Software 6.0.0
Not Vulnerable:

Cisco FireSIGHT System Software Cross Site Scripting and HTML-injection Vulnerabilities

Cisco FireSIGHT System Software is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary HTML script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks are also possible.

Cisco FireSIGHT System Software 6.0.0 is vulnerable.

This issue being tracked by Cisco Bug ID's CSCus93566, CSCut31557 and CSCut47196.

Cisco FireSIGHT System Software Cross Site Scripting and HTML-injection Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.

Cisco FireSIGHT System Software Cross Site Scripting and HTML-injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco FireSIGHT System Software Cross Site Scripting and HTML-injection Vulnerabilities

References:

• Cisco FireSIGHT Management Center Home Page (Cisco)
  
• Cisco FireSIGHT Management Center XSS and HTML Injection Vulnerabilities (Cisco)