CVE-2018-0186: XSS
First published: Wed Mar 28 2018(Updated: )
Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | <16.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0186?
CVE-2018-0186 is rated as high severity due to its potential to allow unauthenticated remote attackers to exploit cross-site scripting vulnerabilities.
How do I fix CVE-2018-0186?
To fix CVE-2018-0186, update your Cisco IOS XE Software to a version that is not affected, specifically versions later than 16.3.6.
What type of attack is possible with CVE-2018-0186?
CVE-2018-0186 can allow attackers to conduct cross-site scripting (XSS) attacks against users of the web-based user interface.
Which Cisco IOS XE Software versions are affected by CVE-2018-0186?
CVE-2018-0186 affects Cisco IOS XE Software versions up to, but not including, 16.3.6.
Can CVE-2018-0186 be exploited by authenticated users?
CVE-2018-0186 does not require authentication, allowing unauthenticated remote attackers to exploit the vulnerability.
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe web ui