CVE-2012-5992: XSS
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtusercreate.html or (2) insert XSS sequences via the headline parameter to screens/base/webauthcustom.html, aka Bug ID CSCud50283.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5992?
CVE-2012-5992 is classified as a medium severity vulnerability due to its potential exploitation through cross-site request forgery.
How do I fix CVE-2012-5992?
To fix CVE-2012-5992, update the Cisco Wireless LAN Controller to a version that addresses the CSRF vulnerabilities.
What systems are affected by CVE-2012-5992?
The vulnerable systems include Cisco Wireless LAN Controllers running software version 7.2.110.0 and various models from the 2000, 2500, 4100, 4400, 5500, 7500, and 8500 series.
What is a cross-site request forgery in the context of CVE-2012-5992?
Cross-site request forgery in CVE-2012-5992 allows an attacker to trick an authenticated administrator into executing unwanted actions on Cisco WLC devices.
Can CVE-2012-5992 lead to unauthorized access?
Yes, if exploited, CVE-2012-5992 can allow remote attackers to hijack administrator sessions and gain unauthorized access to management functions.