cisco-sa-wsa-xss-RuB5WGqL: Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-xss-RuB5WGqL
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-wsa-xss-RuB5WGqL?
The severity of the cisco-sa-wsa-xss-RuB5WGqL vulnerability is considered high due to the potential for a stored cross-site scripting attack.
How do I fix cisco-sa-wsa-xss-RuB5WGqL?
To fix the cisco-sa-wsa-xss-RuB5WGqL vulnerability, it is recommended to update the Cisco Web Security Appliance to the latest version that addresses this issue.
Who is affected by cisco-sa-wsa-xss-RuB5WGqL?
The cisco-sa-wsa-xss-RuB5WGqL vulnerability affects users of the web-based management interface of the Cisco AsyncOS for Cisco Web Security Appliance.
What type of attack can be executed due to cisco-sa-wsa-xss-RuB5WGqL?
Due to the cisco-sa-wsa-xss-RuB5WGqL vulnerability, an attacker can execute a stored cross-site scripting (XSS) attack.
Is authentication required to exploit cisco-sa-wsa-xss-RuB5WGqL?
Yes, authentication is required for an attacker to exploit the cisco-sa-wsa-xss-RuB5WGqL vulnerability.