CVE-2017-12348: XSS
Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected interface or hijack a valid session ID from a user of the affected interface. Cisco Bug IDs: CSCvf71978, CSCvf71986.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-12348?
CVE-2017-12348 is a vulnerability in the web-based management interface of Cisco UCS Central Software that allows a remote attacker to conduct a cross-site scripting (XSS) attack or hijack a valid session ID.
How severe is CVE-2017-12348?
CVE-2017-12348 has a severity rating of 5.4, which is considered medium.
What is the affected software for CVE-2017-12348?
The affected software for CVE-2017-12348 is Cisco Unified Computing System Central Software version 2.2(1a)a.
How can an attacker exploit CVE-2017-12348?
An attacker can exploit CVE-2017-12348 by conducting a cross-site scripting (XSS) attack or hijacking a valid session ID from a user of the affected interface.
Are there any patches or fixes available for CVE-2017-12348?
Yes, Cisco has released a security advisory with patches and fixes for CVE-2017-12348. It is recommended to update to the latest version of Cisco UCS Central Software.