Details of VAR-201601-0052

ID

VAR-201601-0052

CVE

CVE-2016-1294

TITLE

Cisco FireSIGHT system Software Management Center Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2016-001301

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the Management Center in Cisco FireSIGHT System Software 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted cookie, aka Bug ID CSCuw89094. Cisco FireSIGHTManagementCenter centrally manages the network security and operational features of CiscoASAwithFirePOWERServices and Cisco FirePOWER appliances. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug IDs CSCuw89094 and CSCuw89138. Management Center is one of the management center components

Trust: 2.52

sources: NVD: CVE-2016-1294 // JVNDB: JVNDB-2016-001301 // CNVD: CNVD-2016-00385 // BID: 80878 // VULHUB: VHN-90113

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-00385

AFFECTED PRODUCTS

vendor:	cisco	model:	firesight system software	scope:	eq	version:	6.0.1	Trust: 3.3
vendor:	cisco	model:	firesight management center	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2016-00385 // BID: 80878 // JVNDB: JVNDB-2016-001301 // CNNVD: CNNVD-201601-348 // NVD: CVE-2016-1294

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-1294
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-1294
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2016-00385
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201601-348
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-90113
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-1294
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-00385
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-90113
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1294
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2016-00385 // VULHUB: VHN-90113 // JVNDB: JVNDB-2016-001301 // CNNVD: CNNVD-201601-348 // NVD: CVE-2016-1294

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-90113 // JVNDB: JVNDB-2016-001301 // NVD: CVE-2016-1294

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-348

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201601-348

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-001301

PATCH

title:	cisco-sa-20160115-fmc1	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160115-fmc1	Trust: 0.8
title:	Patch for CiscoFireSIGHTSystemSoftware Cross-Site Scripting Vulnerability (CNVD-2016-00385)	url:	https://www.cnvd.org.cn/patchInfo/show/70319	Trust: 0.6
title:	Cisco FireSIGHT System Software Management Center Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59666	Trust: 0.6

sources: CNVD: CNVD-2016-00385 // JVNDB: JVNDB-2016-001301 // CNNVD: CNNVD-201601-348

EXTERNAL IDS

db:	NVD	id:	CVE-2016-1294	Trust: 3.4
db:	SECTRACK	id:	1034690	Trust: 1.1
db:	JVNDB	id:	JVNDB-2016-001301	Trust: 0.8
db:	CNNVD	id:	CNNVD-201601-348	Trust: 0.7
db:	CNVD	id:	CNVD-2016-00385	Trust: 0.6
db:	BID	id:	80878	Trust: 0.4
db:	VULHUB	id:	VHN-90113	Trust: 0.1

sources: CNVD: CNVD-2016-00385 // VULHUB: VHN-90113 // BID: 80878 // JVNDB: JVNDB-2016-001301 // CNNVD: CNNVD-201601-348 // NVD: CVE-2016-1294

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160115-fmc1	Trust: 2.0
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1294	Trust: 1.4
url:	http://www.securitytracker.com/id/1034690	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1294	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2016-00385 // VULHUB: VHN-90113 // BID: 80878 // JVNDB: JVNDB-2016-001301 // CNNVD: CNNVD-201601-348 // NVD: CVE-2016-1294

CREDITS

Cisco

Trust: 0.3

sources: BID: 80878

SOURCES

db:	CNVD	id:	CNVD-2016-00385
db:	VULHUB	id:	VHN-90113
db:	BID	id:	80878
db:	JVNDB	id:	JVNDB-2016-001301
db:	CNNVD	id:	CNNVD-201601-348
db:	NVD	id:	CVE-2016-1294

LAST UPDATE DATE

2024-11-23T22:59:30.448000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-00385	date:	2016-01-21T00:00:00
db:	VULHUB	id:	VHN-90113	date:	2016-12-07T00:00:00
db:	BID	id:	80878	date:	2016-01-15T00:00:00
db:	JVNDB	id:	JVNDB-2016-001301	date:	2016-01-26T00:00:00
db:	CNNVD	id:	CNNVD-201601-348	date:	2016-01-18T00:00:00
db:	NVD	id:	CVE-2016-1294	date:	2024-11-21T02:46:07.973

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-00385	date:	2016-01-21T00:00:00
db:	VULHUB	id:	VHN-90113	date:	2016-01-16T00:00:00
db:	BID	id:	80878	date:	2016-01-15T00:00:00
db:	JVNDB	id:	JVNDB-2016-001301	date:	2016-01-26T00:00:00
db:	CNNVD	id:	CNNVD-201601-348	date:	2016-01-18T00:00:00
db:	NVD	id:	CVE-2016-1294	date:	2016-01-16T05:59:06.473