CVE-2015-6374: Input Validation

Published Nov 19, 2015

Updated

The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604.

Affected Software

1 affected component

Cisco Firepower Extensible Operating System=1.1\(1.160\)

Event History

Nov 19, 2015

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6374?

The severity of CVE-2015-6374 is classified as high due to its potential to allow clickjacking attacks.

How do I fix CVE-2015-6374?

To fix CVE-2015-6374, upgrade the Cisco Firepower Extensible Operating System to the latest version that addresses this vulnerability.

What devices are affected by CVE-2015-6374?

CVE-2015-6374 affects Cisco Firepower 9000 devices running Firepower Extensible Operating System version 1.1(1.160).

What type of attack can be executed due to CVE-2015-6374?

CVE-2015-6374 makes it easier for remote attackers to conduct clickjacking attacks through a crafted web site.

Is there a workaround for CVE-2015-6374?

There are currently no documented workarounds for CVE-2015-6374, and upgrading is the recommended mitigation.