CVE-2018-0188: XSS
First published: Wed Mar 28 2018(Updated: )
Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Software | <16.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0188?
The severity of CVE-2018-0188 is considered high due to its potential for exploitation through cross-site scripting attacks.
How do I fix CVE-2018-0188?
To mitigate CVE-2018-0188, it is recommended to upgrade to Cisco IOS XE version 16.3.7 or later.
What type of attack can CVE-2018-0188 facilitate?
CVE-2018-0188 can facilitate cross-site scripting (XSS) attacks that target users of the Cisco web UI.
Which Cisco IOS XE versions are affected by CVE-2018-0188?
CVE-2018-0188 affects Cisco IOS XE versions prior to 16.3.7.
Can CVE-2018-0188 be exploited by unauthenticated users?
Yes, CVE-2018-0188 can be exploited by unauthenticated remote attackers.
- agent/references
- agent/weakness
- agent/type
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe