CVE-2013-6698: Medium severity Cisco wireless LAN controller vulnerability

Published Nov 22, 2013

Updated

The web interface on Cisco Wireless LAN Controller (WLC) devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf77821.

Affected Software

1 affected component

Cisco wireless LAN controller

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CSCuf77821

Event History

Nov 22, 2013

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·07:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6698?

CVE-2013-6698 is considered a moderate severity vulnerability.

How do I fix CVE-2013-6698?

To address CVE-2013-6698, ensure that you are running the latest firmware version for your Cisco Wireless LAN Controller.

What attacks can be executed due to CVE-2013-6698?

CVE-2013-6698 can enable remote attackers to conduct clickjacking attacks and potentially execute other unspecified attacks.

Which Cisco products are affected by CVE-2013-6698?

CVE-2013-6698 affects various models of Cisco Wireless LAN Controllers.

What causes the vulnerability in CVE-2013-6698?

The vulnerability in CVE-2013-6698 is caused by improper restriction involving IFRAME elements in the web interface of Cisco Wireless LAN Controllers.