Sign-up

ID

VAR-201610-0285


CVE

CVE-2016-6436


TITLE

Cisco Host Scan HostScan Engine Cross-Site Scripting Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2016-09578 // CNNVD: CNNVD-201610-133

DESCRIPTION

Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682. CiscoAdaptiveSecurityAppliancesWebVPN is a set of modules for configuring WebVPN on the ASA firewall. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCuz14682. HostScan Engine is a host scanning engine

Trust: 2.52

sources: NVD: CVE-2016-6436 // JVNDB: JVNDB-2016-005144 // CNVD: CNVD-2016-09578 // BID: 93407 // VULHUB: VHN-95256

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-09578

AFFECTED PRODUCTS

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.04075

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05183

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.01065

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05163

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.02040

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.04082

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05170

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.03103

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05160

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05182

Trust: 1.6

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05178

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.0.08066

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.05152

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.14018

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.03104

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.04063

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.04060

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.0.08062

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.02043

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.02016

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.02026

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.1.06073

Trust: 1.0

vendor:ciscomodel:hostscan enginescope:eqversion:3.0.08062 to 3.1.14018

Trust: 0.8

vendor:ciscomodel:hostscan enginescope:gteversion:3.0.08062,<=3.1.14018

Trust: 0.6

vendor:ciscomodel:host scan packagescope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2016-09578 // BID: 93407 // JVNDB: JVNDB-2016-005144 // CNNVD: CNNVD-201610-133 // NVD: CVE-2016-6436

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6436
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-6436
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-09578
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201610-133
value: MEDIUM

Trust: 0.6

VULHUB: VHN-95256
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-6436
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-09578
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-95256
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6436
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2016-09578 // VULHUB: VHN-95256 // JVNDB: JVNDB-2016-005144 // CNNVD: CNNVD-201610-133 // NVD: CVE-2016-6436

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-95256 // JVNDB: JVNDB-2016-005144 // NVD: CVE-2016-6436

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-133

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201610-133

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005144

PATCH
title:cisco-sa-20161005-chsurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs
Trust: 0.8
title:Patch for CiscoHostScanHostScanEngine Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/82708
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-09578 // 
            
            
            
            JVNDB: JVNDB-2016-005144

EXTERNAL IDS
db:NVDid:CVE-2016-6436
Trust: 3.4
db:BIDid:93407
Trust: 1.4
db:JVNDBid:JVNDB-2016-005144
Trust: 0.8
db:CNNVDid:CNNVD-201610-133
Trust: 0.7
db:CNVDid:CNVD-2016-09578
Trust: 0.6
db:VULHUBid:VHN-95256
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-09578 // 
            
            
            
            VULHUB: VHN-95256 // 
            
            
            
            BID: 93407 // 
            
            
            
            JVNDB: JVNDB-2016-005144 // 
            
            
            
            CNNVD: CNNVD-201610-133 // 
            
            
            
            NVD: CVE-2016-6436

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161005-chs
Trust: 2.6
url:http://www.securityfocus.com/bid/93407
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6436
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6436
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-09578 // 
            
            
            
            VULHUB: VHN-95256 // 
            
            
            
            BID: 93407 // 
            
            
            
            JVNDB: JVNDB-2016-005144 // 
            
            
            
            CNNVD: CNNVD-201610-133 // 
            
            
            
            NVD: CVE-2016-6436

CREDITS
Cisco.
Trust: 0.3
sources:
            
            
            BID: 93407

SOURCES
db:CNVDid:CNVD-2016-09578
db:VULHUBid:VHN-95256
db:BIDid:93407
db:JVNDBid:JVNDB-2016-005144
db:CNNVDid:CNNVD-201610-133
db:NVDid:CVE-2016-6436

LAST UPDATE DATE
2024-11-23T22:34:47.820000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-09578date:2016-10-20T00:00:00
db:VULHUBid:VHN-95256date:2016-11-28T00:00:00
db:BIDid:93407date:2016-10-10T00:05:00
db:JVNDBid:JVNDB-2016-005144date:2016-10-12T00:00:00
db:CNNVDid:CNNVD-201610-133date:2016-10-12T00:00:00
db:NVDid:CVE-2016-6436date:2024-11-21T02:56:07.790

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-09578date:2016-10-20T00:00:00
db:VULHUBid:VHN-95256date:2016-10-06T00:00:00
db:BIDid:93407date:2016-10-05T00:00:00
db:JVNDBid:JVNDB-2016-005144date:2016-10-12T00:00:00
db:CNNVDid:CNNVD-201610-133date:2016-10-12T00:00:00
db:NVDid:CVE-2016-6436date:2016-10-06T10:59:17.570