CVE-2017-6782
published 2017-08-17CVE-2017-6782: A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web…
PriorityP427medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.89%
55.2th percentile
A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An attacker could exploit this vulnerability by injecting malicious code into an affected parameter and persuading a user to access a web page that triggers the rendering of the injected code. Cisco Bug IDs: CSCve47074. Known Affected Releases: 3.2(0.0).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure_html | — | — |
| cisco_systems_inc | prime_infrastructure | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
vendor_cisco5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Infrastructure HTML Injection Vulnerability
vendor_cisco·2017-08-16·CVSS 5.4
CVE-2017-6782 [MEDIUM] CWE-94 Cisco Prime Infrastructure HTML Injection Vulnerability
Cisco Prime Infrastructure HTML Injection Vulnerability
A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application.
The vulnerability is due to improper sanitization of parameter values by the affected application. An attacker could exploit this vulnerability by injecting malicious code into an affected parameter and persuading a user to access a web page that triggers the rendering of the injected code.
For additional information about HTML injection attacks and potential mitigation methods, see https://www.owasp.org/index.php/Testing_for_HTML_Injection_(OTG-CLIENT-003).
There are no workarounds that address this vulnerability.
This advisory is availa
Cisco
Cisco Prime Infrastructure HTML Injection Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6782 Cisco Prime Infrastructure HTML Injection Vulnerability
CVE-2017-6782: Cisco Prime Infrastructure HTML Injection Vulnerability
A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An attacker could exploit this vulnerability by injecting malicious code into an affected parameter and persuading a user to access a web page that triggers the rendering of the injected code. For additional information about HTML injection attacks and potential mitigation methods, see https://www.owasp.org/index.php/Testing_for_HTML_Injection_(OTG-CLIENT-003) . There are no
CVSS: 3.0
CWE: CWE-94, CWE-94
Bug IDs: CSCve47074
GHSA
GHSA-h6f7-wjm5-gjgh: A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in th
ghsa_unreviewed·2022-05-17
CVE-2017-6782 [MEDIUM] CWE-94 GHSA-h6f7-wjm5-gjgh: A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in th
A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An attacker could exploit this vulnerability by injecting malicious code into an affected parameter and persuading a user to access a web page that triggers the rendering of the injected code. Cisco Bug IDs: CSCve47074. Known Affected Releases: 3.2(0.0).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/100366http://www.securitytracker.com/id/1039189https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cpihttp://www.securityfocus.com/bid/100366http://www.securitytracker.com/id/1039189https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cpi
2017-08-17
Published