Cisco FirePOWER Management Center cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in Cisco FirePOWER Management Center. This issue affects some unknown processing of the component Management Center. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2017-12221. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco FirePOWER Management Center (Firewall Software) (affected version not known). Affected by this issue is some unknown functionality of the component Management Center. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in the context of the affected system. Cisco Bug IDs: CSCvc38983.

The bug was discovered 09/06/2017. The weakness was published 09/07/2017 as cisco-sa-20170906-firepower-2 as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2017-12221 since 08/03/2017. The attack may be launched remotely. A simple authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability scanner Nessus provides a plugin with the ID 103193 (Cisco Firepower Management Center Multiple XSS), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CISCO and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (103193) and SecurityFocus (BID 100640†). Similar entry is available at VDB-106219. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• FirePOWER Management Center

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion