SB2018011812 - Multiple vulnerabilities in Cisco Small Business 300 and 500
Published: January 18, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Reflected cross-site scripting (CVE-ID: CVE-2017-12307)
The disclosed vulnerability allows a remote attacker to perform reflected cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) HTTP response splitting attack (CVE-ID: CVE-2017-12308)
The disclosed vulnerability allows a remote attacker to perform HTTP response splitting attack.
The vulnerability exists in the web framework of Cisco Small Business Managed Switches software due to insufficient input validation of some parameters that are passed to the web server. A remote attacker can convince a user to follow a malicious link or intercept a user request and inject malicious code into the request, execute arbitrary script code in the context of the affected web interface and access sensitive browser-based information.
Remediation
Install update from vendor's website.