Sign-up

ID

VAR-201909-0181


CVE

CVE-2019-12668


TITLE

Cisco IOS and Cisco IOS XE Software cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-010296

DESCRIPTION

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected software using the banner parameter. The vulnerability is due to insufficient input validation of the banner parameters that are passed to the web server of the affected software. An attacker could exploit this vulnerability by crafting a banner parameter and saving it. The attacker could then convince a user of the web interface to access a malicious link or could intercept a user request for the affected web interface and inject malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information

Trust: 1.71

sources: NVD: CVE-2019-12668 // JVNDB: JVNDB-2019-010296 // VULHUB: VHN-144437

AFFECTED PRODUCTS

vendor:ciscomodel:iosscope:eqversion:15.2\(5\)e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(5\)ex

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.9e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.1.1

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:16.8.2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.6e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(2\)e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(7\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(2\)ea

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.7.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7e

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:16.9.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8e

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:16.6.5

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:16.3.8

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(5\)ea

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)ec

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)ea

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(6\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.9.1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)ea

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.4.1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.1.1

Trust: 1.0

vendor:ciscomodel:iosscope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:iosscope:eqversion:15.25e

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.25ex

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.24e

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.24ec

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.23ea

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.22e

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.23e

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.24ea

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.25ea

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.22ea

Trust: 0.6

sources: JVNDB: JVNDB-2019-010296 // CNNVD: CNNVD-201909-1119 // NVD: CVE-2019-12668

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-12668
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-12668
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-12668
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201909-1119
value: MEDIUM

Trust: 0.6

VULHUB: VHN-144437
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2019-12668
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-144437
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

ykramarz@cisco.com: CVE-2019-12668
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-12668
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-144437 // JVNDB: JVNDB-2019-010296 // CNNVD: CNNVD-201909-1119 // NVD: CVE-2019-12668 // NVD: CVE-2019-12668

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-144437 // JVNDB: JVNDB-2019-010296 // NVD: CVE-2019-12668

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-1119

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201909-1119

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-010296

PATCH
title:cisco-sa-20190925-sbxssurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sbxss
Trust: 0.8
title:Cisco IOS  and IOS XE Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98537
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-010296 // 
            
            
            
            CNNVD: CNNVD-201909-1119

EXTERNAL IDS
db:NVDid:CVE-2019-12668
Trust: 2.5
db:JVNDBid:JVNDB-2019-010296
Trust: 0.8
db:CNNVDid:CNNVD-201909-1119
Trust: 0.7
db:AUSCERTid:ESB-2019.3614
Trust: 0.6
db:VULHUBid:VHN-144437
Trust: 0.1
sources:
            
            
            VULHUB: VHN-144437 // 
            
            
            
            JVNDB: JVNDB-2019-010296 // 
            
            
            
            CNNVD: CNNVD-201909-1119 // 
            
            
            
            NVD: CVE-2019-12668

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190925-sbxss
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-12668
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-12668
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190925-sip-dos
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190925-identd-dos
Trust: 0.6
url:http-client
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190925-tsec
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3614/
Trust: 0.6
url:https://vigilance.fr/vulnerability/cisco-ios-ios-xe-cross-site-scripting-via-stored-banner-30438
Trust: 0.6
sources:
            
            
            VULHUB: VHN-144437 // 
            
            
            
            JVNDB: JVNDB-2019-010296 // 
            
            
            
            CNNVD: CNNVD-201909-1119 // 
            
            
            
            NVD: CVE-2019-12668

CREDITS
Nishith Sinha
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201909-1119

SOURCES
db:VULHUBid:VHN-144437
db:JVNDBid:JVNDB-2019-010296
db:CNNVDid:CNNVD-201909-1119
db:NVDid:CVE-2019-12668

LAST UPDATE DATE
2024-08-14T13:25:47.795000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-144437date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2019-010296date:2019-10-10T00:00:00
db:CNNVDid:CNNVD-201909-1119date:2019-10-17T00:00:00
db:NVDid:CVE-2019-12668date:2019-10-09T23:46:01.810

SOURCES RELEASE DATE
db:VULHUBid:VHN-144437date:2019-09-25T00:00:00
db:JVNDBid:JVNDB-2019-010296date:2019-10-10T00:00:00
db:CNNVDid:CNNVD-201909-1119date:2019-09-25T00:00:00
db:NVDid:CVE-2019-12668date:2019-09-25T21:15:11.577