Details of VAR-201803-1606

ID

VAR-201803-1606

CVE

CVE-2018-0186

TITLE

Cisco IOS XE Software cross-site scripting vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009

DESCRIPTION

Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022. Vendors have confirmed this vulnerability Bug ID CSCuz38591 , CSCvb09530 ,and CSCvb10022 It is released as.Information may be obtained and information may be altered. Cisco IOSXESoftware is a set of operating systems developed by Cisco for its network devices. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks

Trust: 2.52

sources: NVD: CVE-2018-0186 // JVNDB: JVNDB-2018-003432 // CNVD: CNVD-2018-08003 // BID: 103551 // VULHUB: VHN-118388

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-08003

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	lt	version:	16.3.6	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	16.2	Trust: 0.9
vendor:	cisco	model:	ios	scope:	eq	version:	16.1.2	Trust: 0.9
vendor:	cisco	model:	ios	scope:	eq	version:	16.3(0)	Trust: 0.9
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe software	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.1.1	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	13.10.2s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18.0as	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	15.4\(3\)s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17s_3.17.0s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17s.0	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	16.3.4	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.18.0s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.17s.1	Trust: 0.6
vendor:	cisco	model:	ios xe software	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2018-08003 // BID: 103551 // JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009 // NVD: CVE-2018-0186

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0186
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0186
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-08003
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201803-1009
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-118388
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0186
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-08003
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-118388
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0186
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-08003 // VULHUB: VHN-118388 // JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009 // NVD: CVE-2018-0186

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-118388 // JVNDB: JVNDB-2018-003432 // NVD: CVE-2018-0186

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-1009

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201803-1009

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003432

PATCH

title:	cisco-sa-20180328-webuixss	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-webuixss	Trust: 0.8
title:	Patch for Cisco IOSXE Cross-Site Scripting Vulnerability (CNVD-2018-08003)	url:	https://www.cnvd.org.cn/patchInfo/show/126515	Trust: 0.6
title:	Cisco IOS XE Software Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79477	Trust: 0.6

sources: CNVD: CNVD-2018-08003 // JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0186	Trust: 3.4
db:	BID	id:	103551	Trust: 2.6
db:	JVNDB	id:	JVNDB-2018-003432	Trust: 0.8
db:	CNNVD	id:	CNNVD-201803-1009	Trust: 0.7
db:	CNVD	id:	CNVD-2018-08003	Trust: 0.6
db:	VULHUB	id:	VHN-118388	Trust: 0.1

sources: CNVD: CNVD-2018-08003 // VULHUB: VHN-118388 // BID: 103551 // JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009 // NVD: CVE-2018-0186

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-webuixss	Trust: 2.6
url:	http://www.securityfocus.com/bid/103551	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0186	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0186	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2018-08003 // VULHUB: VHN-118388 // BID: 103551 // JVNDB: JVNDB-2018-003432 // CNNVD: CNNVD-201803-1009 // NVD: CVE-2018-0186

CREDITS

Cisco

Trust: 0.3

sources: BID: 103551

SOURCES

db:	CNVD	id:	CNVD-2018-08003
db:	VULHUB	id:	VHN-118388
db:	BID	id:	103551
db:	JVNDB	id:	JVNDB-2018-003432
db:	CNNVD	id:	CNNVD-201803-1009
db:	NVD	id:	CVE-2018-0186

LAST UPDATE DATE

2024-11-23T21:53:19.856000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-08003	date:	2018-04-20T00:00:00
db:	VULHUB	id:	VHN-118388	date:	2019-10-09T00:00:00
db:	BID	id:	103551	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003432	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1009	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0186	date:	2024-11-21T03:37:41.397

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-08003	date:	2018-04-19T00:00:00
db:	VULHUB	id:	VHN-118388	date:	2018-03-28T00:00:00
db:	BID	id:	103551	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003432	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1009	date:	2018-03-29T00:00:00
db:	NVD	id:	CVE-2018-0186	date:	2018-03-28T22:29:01.873