First published: Wed Mar 24 2021(Updated: )
A vulnerability in the web-based management interface of Cisco IOS XE Wireless Controller software for the Catalyst 9000 Family of switches could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by authenticating to the device as a high-privileged user, adding certain configurations with malicious code in one of its fields, and persuading another user to click on it. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco IOS XE | =16.6.1 | |
Cisco IOS XE | =16.6.2 | |
Cisco IOS XE | =16.6.3 | |
Cisco IOS XE | =16.6.4 | |
Cisco IOS XE | =16.6.4a | |
Cisco IOS XE | =16.6.4s | |
Cisco IOS XE | =16.6.5 | |
Cisco IOS XE | =16.6.5a | |
Cisco IOS XE | =16.6.5b | |
Cisco IOS XE | =16.6.6 | |
Cisco IOS XE | =16.6.7 | |
Cisco IOS XE | =16.6.7a | |
Cisco IOS XE | =16.6.8 | |
Cisco IOS XE | =16.7.1 | |
Cisco IOS XE | =16.7.1a | |
Cisco IOS XE | =16.7.1b | |
Cisco IOS XE | =16.7.2 | |
Cisco IOS XE | =16.7.3 | |
Cisco IOS XE | =16.7.4 | |
Cisco IOS XE | =16.8.1 | |
Cisco IOS XE | =16.8.1a | |
Cisco IOS XE | =16.8.1b | |
Cisco IOS XE | =16.8.1c | |
Cisco IOS XE | =16.8.1d | |
Cisco IOS XE | =16.8.1e | |
Cisco IOS XE | =16.8.1s | |
Cisco IOS XE | =16.8.2 | |
Cisco IOS XE | =16.8.3 | |
Cisco IOS XE | =16.9.1 | |
Cisco IOS XE | =16.9.1a | |
Cisco IOS XE | =16.9.1b | |
Cisco IOS XE | =16.9.1c | |
Cisco IOS XE | =16.9.1d | |
Cisco IOS XE | =16.9.1s | |
Cisco IOS XE | =16.9.2 | |
Cisco IOS XE | =16.9.2a | |
Cisco IOS XE | =16.9.2s | |
Cisco IOS XE | =16.9.3 | |
Cisco IOS XE | =16.9.3a | |
Cisco IOS XE | =16.9.3h | |
Cisco IOS XE | =16.9.3s | |
Cisco IOS XE | =16.9.4 | |
Cisco IOS XE | =16.9.4c | |
Cisco IOS XE | =16.9.5 | |
Cisco IOS XE | =16.9.5f | |
Cisco IOS XE | =16.10.1 | |
Cisco IOS XE | =16.10.1a | |
Cisco IOS XE | =16.10.1b | |
Cisco IOS XE | =16.10.1c | |
Cisco IOS XE | =16.10.1d | |
Cisco IOS XE | =16.10.1e | |
Cisco IOS XE | =16.10.1f | |
Cisco IOS XE | =16.10.1g | |
Cisco IOS XE | =16.10.1s | |
Cisco IOS XE | =16.10.2 | |
Cisco IOS XE | =16.10.3 | |
Cisco IOS XE | =16.11.1 | |
Cisco IOS XE | =16.11.1a | |
Cisco IOS XE | =16.11.1b | |
Cisco IOS XE | =16.11.1c | |
Cisco IOS XE | =16.11.1s | |
Cisco IOS XE | =16.11.2 | |
Cisco IOS XE | =16.12.1 | |
Cisco IOS XE | =16.12.1a | |
Cisco IOS XE | =16.12.1c | |
Cisco IOS XE | =16.12.1s | |
Cisco IOS XE | =16.12.1t | |
Cisco IOS XE | =16.12.1w | |
Cisco IOS XE | =16.12.1x | |
Cisco IOS XE | =16.12.1y | |
Cisco IOS XE | =16.12.1z | |
Cisco IOS XE | =16.12.2 | |
Cisco IOS XE | =16.12.2a | |
Cisco IOS XE | =16.12.2s | |
Cisco IOS XE | =16.12.2t | |
Cisco IOS XE | =16.12.3 | |
Cisco IOS XE | =16.12.3a | |
Cisco IOS XE | =16.12.3s | |
Cisco IOS XE | =16.12.4 | |
Cisco IOS XE | =16.12.4a | |
Cisco IOS XE | =17.1.1 | |
Cisco IOS XE | =17.1.1a | |
Cisco IOS XE | =17.1.1s | |
Cisco IOS XE | =17.1.1t | |
Cisco IOS XE | =17.1.2 | |
Cisco IOS XE | =17.2.1 | |
Cisco IOS XE | =17.2.1a | |
Cisco IOS XE | =17.2.1r | |
Cisco IOS XE | =17.2.1v |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.