Cisco Web Security Appliance CVE-2017-6749 HTML Injection Vulnerability

Bugtraq ID:	99875
Class:	Input Validation Error
CVE:	CVE-2017-6749
Remote:	Yes
Local:	No
Published:	Jul 19 2017 12:00AM
Updated:	Jul 19 2017 12:00AM
Credit:	Daniel Jensen of Security-Assessment.com
Vulnerable:	Cisco Web Security Appliance 10.1.0-204
Not Vulnerable:

Cisco Web Security Appliance CVE-2017-6749 HTML Injection Vulnerability

Cisco Web Security Appliance is prone to a HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

This issue is being tracked by Cisco Bug ID CSCvd88865.

Cisco Web Security Appliance 10.1.0-204 is vulnerable; other versions may also be affected.

Cisco Web Security Appliance CVE-2017-6749 HTML Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Cisco Web Security Appliance CVE-2017-6749 HTML Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Web Security Appliance Homepage (Cisco)
  
• Cisco Security Advisories and Alerts (Cisco)
  
• Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability (Cisco)