Sign-up

ID

VAR-201607-0437


CVE

CVE-2016-1462


TITLE

Cisco Prime Service Catalog of Web -Based scripting interface vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2016-004100

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Prime Service Catalog (PSC) 11.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuz63795. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCuz63795. The solution supports automated ordering of a unified service catalog of computing, networking, storage, and other data center resources

Trust: 1.98

sources: NVD: CVE-2016-1462 // JVNDB: JVNDB-2016-004100 // BID: 92156 // VULHUB: VHN-90281

AFFECTED PRODUCTS

vendor:ciscomodel:prime service catalogscope:eqversion:11.0_base

Trust: 1.6

vendor:ciscomodel:prime service catalogscope:eqversion:11.0

Trust: 1.1

sources: BID: 92156 // JVNDB: JVNDB-2016-004100 // CNNVD: CNNVD-201607-996 // NVD: CVE-2016-1462

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1462
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-1462
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201607-996
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90281
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1462
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-90281
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1462
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-90281 // JVNDB: JVNDB-2016-004100 // CNNVD: CNNVD-201607-996 // NVD: CVE-2016-1462

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-90281 // JVNDB: JVNDB-2016-004100 // NVD: CVE-2016-1462

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201607-996

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201607-996

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-004100

PATCH
title:cisco-sa-20160727-pscurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160727-psc
Trust: 0.8
title:Cisco Prime Service Catalog Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=63332
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-004100 // 
            
            
            
            CNNVD: CNNVD-201607-996

EXTERNAL IDS
db:NVDid:CVE-2016-1462
Trust: 2.8
db:BIDid:92156
Trust: 1.4
db:SECTRACKid:1036472
Trust: 1.1
db:JVNDBid:JVNDB-2016-004100
Trust: 0.8
db:CNNVDid:CNNVD-201607-996
Trust: 0.7
db:VULHUBid:VHN-90281
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90281 // 
            
            
            
            BID: 92156 // 
            
            
            
            JVNDB: JVNDB-2016-004100 // 
            
            
            
            CNNVD: CNNVD-201607-996 // 
            
            
            
            NVD: CVE-2016-1462

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160727-psc
Trust: 1.7
url:http://www.securityfocus.com/bid/92156
Trust: 1.1
url:http://www.securitytracker.com/id/1036472
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1462
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1462
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:http://tools.cisco.com/security/center/viewalert.x?alertid=40214
Trust: 0.3
sources:
            
            
            VULHUB: VHN-90281 // 
            
            
            
            BID: 92156 // 
            
            
            
            JVNDB: JVNDB-2016-004100 // 
            
            
            
            CNNVD: CNNVD-201607-996 // 
            
            
            
            NVD: CVE-2016-1462

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 92156

SOURCES
db:VULHUBid:VHN-90281
db:BIDid:92156
db:JVNDBid:JVNDB-2016-004100
db:CNNVDid:CNNVD-201607-996
db:NVDid:CVE-2016-1462

LAST UPDATE DATE
2024-11-23T21:42:55.892000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-90281date:2017-09-01T00:00:00
db:BIDid:92156date:2016-07-27T00:00:00
db:JVNDBid:JVNDB-2016-004100date:2016-08-01T00:00:00
db:CNNVDid:CNNVD-201607-996date:2016-07-28T00:00:00
db:NVDid:CVE-2016-1462date:2024-11-21T02:46:29.343

SOURCES RELEASE DATE
db:VULHUBid:VHN-90281date:2016-07-28T00:00:00
db:BIDid:92156date:2016-07-27T00:00:00
db:JVNDBid:JVNDB-2016-004100date:2016-08-01T00:00:00
db:CNNVDid:CNNVD-201607-996date:2016-07-28T00:00:00
db:NVDid:CVE-2016-1462date:2016-07-28T01:59:42.697