CVE-2015-6400
published 2015-12-13CVE-2015-6400: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
0.95%
57.6th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | emergency_responder | — | — |
| cisco | emergency_responder_web_framework | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
vendor_cisco·2015-12-10·CVSS 4.3
CVE-2015-6400 [MEDIUM] CWE-352 Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Emergency Responder Software could allow an unauthenticated, remote attacker to execute a stored cross-site scripting (XSS) attack against the user of the web interface.
The vulnerability is due to insufficient validation on the input fields of a web form. An attacker could exploit this vulnerability by entering malicious code in an affected form that is then stored in the database.
Cisco has not released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-cer
Cisco
Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
vendor_cisco
CVE-2015-6400 Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
CVE-2015-6400: Cisco Emergency Responder Web Framework Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Emergency Responder Software could allow an unauthenticated, remote attacker to execute a stored cross-site scripting (XSS) attack against the user of the web interface. The vulnerability is due to insufficient validation on the input fields of a web form. An attacker could exploit this vulnerability by entering malicious code in an affected form that is then stored in the database. Cisco has not released software updates that address this vulnerability.
CWE: CWE-352, CWE-352
Bug IDs: CSCuv25547
GHSA
GHSA-p9w2-cvmw-22mw: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10
ghsa_unreviewed·2022-05-17
CVE-2015-6400 [MEDIUM] CWE-79 GHSA-p9w2-cvmw-22mw: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547.
No detection rules found.
No writeups or analysis indexed.
2015-12-13
Published