Cisco Firepower Management Center CVE-2017-6716 HTML Injection Vulnerability
BID:99220
Info
Cisco Firepower Management Center CVE-2017-6716 HTML Injection Vulnerability
| Bugtraq ID: | 99220 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-6716 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 21 2017 12:00AM |
| Updated: | Jun 21 2017 12:00AM |
| Credit: | Cisco |
| Vulnerable: |
Cisco FirePOWER Management Center 5.4.1 Cisco FirePOWER Management Center 5.4 Cisco FirePOWER Management Center 5.3.1 Cisco FirePOWER Management Center 5.3 Cisco FirePOWER Management Center 5.2 Cisco FirePOWER Management Center 4.10.3 Cisco FirePOWER Management Center 5.4.1.9 Cisco FirePOWER Management Center 5.4.1.6 Cisco FirePOWER Management Center 5.4.1.3 Cisco FirePOWER Management Center 5.4.0.10 Cisco FirePOWER Management Center 5.4.0.1 Cisco FirePOWER Management Center 5.3.1.2 Cisco FirePOWER Management Center 5.3.0.4 Cisco FirePOWER Management Center 5.3.0.3 Cisco FirePOWER Management Center 5.3.0.2 Cisco FirePOWER Management Center 5.0 Cisco FirePOWER Management Center 4.10.3.9 |
| Not Vulnerable: |
Cisco FirePOWER Management Center 6.0.0.0 |
Discussion
Cisco Firepower Management Center CVE-2017-6716 HTML Injection Vulnerability
Cisco Firepower Management Center is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
This issue is being tracked by Cisco Bug ID CSCuy88785.
Versions prior to Cisco Firepower Management Center 6.0.0.0 are vulnerable.
Cisco Firepower Management Center is prone to an HTML-injection vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
This issue is being tracked by Cisco Bug ID CSCuy88785.
Versions prior to Cisco Firepower Management Center 6.0.0.0 are vulnerable.
Exploit / POC
Cisco Firepower Management Center CVE-2017-6716 HTML Injection Vulnerability
Attackers can exploit this issue using browser.
Attackers can exploit this issue using browser.