Cisco Access Control System CVE-2017-6769 HTML Injection Vulnerability

Bugtraq ID:	99985
Class:	Input Validation Error
CVE:	CVE-2017-6769
Remote:	Yes
Local:	No
Published:	Jul 26 2017 12:00AM
Updated:	Jul 26 2017 12:00AM
Credit:	Mikhail Klyuchnikov from Positive Technologies.
Vulnerable:	Cisco Secure Access Control System 0 Cisco Secure Access Control Server Solution Engine 5.8(1.5) Cisco Secure Access Control Server Solution Engine 5.8(0.8)
Not Vulnerable:

Cisco Access Control System CVE-2017-6769 HTML Injection Vulnerability

Cisco Access Control System is prone to a HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

This issue is being tracked by Cisco Bug ID CSCve70587.

Cisco Access Control System CVE-2017-6769 HTML Injection Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Cisco Access Control System CVE-2017-6769 HTML Injection Vulnerability

References:

• Cisco Homepage (Cisco)
  
• cisco-sa-20170726-acs:Cisco Access Control System Stored Cross-Site Scripting Vu (Cisco)