CVE-2018-0408: XSS
A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi87330.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-0408?
CVE-2018-0408 has a medium severity rating, allowing authenticated remote attackers to perform reflected cross-site scripting attacks.
How do I fix CVE-2018-0408?
To fix CVE-2018-0408, update the affected Cisco Small Business 300 Series firmware to a version above 1.4.7.06.
Which Cisco devices are affected by CVE-2018-0408?
The affected devices include Cisco Sf300-08, Sf302-08, Sf300-24, Sf300-48, and several other models in the Cisco Small Business 300 Series running specific firmware versions.
Can CVE-2018-0408 be exploited without authentication?
CVE-2018-0408 requires authentication to exploit, as the vulnerability is present in the web-based management interface.
What type of attack does CVE-2018-0408 facilitate?
CVE-2018-0408 facilitates reflected cross-site scripting (XSS) attacks, enabling attackers to inject malicious scripts into web pages accessed by users.