CVE-2018-0190: XSS
First published: Wed Mar 28 2018(Updated: )
Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web UI of the affected software. The vulnerabilities are due to insufficient input validation of certain parameters that are passed to the affected software via the web UI. An attacker could exploit these vulnerabilities by persuading a user of the affected UI to access a malicious link or by intercepting a user request for the affected UI and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected UI or allow the attacker to access sensitive browser-based information on the user's system. Cisco Bug IDs: CSCuz38591, CSCvb09530, CSCvb10022.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Web UI | <16.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0190?
CVE-2018-0190 has been classified with a high severity rating due to its potential impact on the security of affected systems.
How do I fix CVE-2018-0190?
To remediate CVE-2018-0190, upgrade Cisco IOS XE Software to a version that is not vulnerable, specifically beyond 16.3.6.
Who is affected by CVE-2018-0190?
CVE-2018-0190 affects users of the web-based user interface of Cisco IOS XE Software versions prior to 16.3.6.
What type of attack can be executed through CVE-2018-0190?
CVE-2018-0190 can be exploited to perform cross-site scripting (XSS) attacks against users of the web UI.
Is authentication required to exploit CVE-2018-0190?
An attacker does not require authentication to exploit CVE-2018-0190, making it particularly dangerous.
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco ios xe web ui