Cisco Digital Network Architecture up to 1.3.0.5/1.3.1.3 Web-based Management Interface Stored cross site scripting

Summaryinfo

A vulnerability has been found in Cisco Digital Network Architecture up to 1.3.0.5/1.3.1.3 and classified as problematic. The affected element is an unknown function of the component Web-based Management Interface. The manipulation leads to cross site scripting (Stored). This vulnerability is referenced as CVE-2019-15253. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Cisco Digital Network Architecture up to 1.3.0.5/1.3.1.3. It has been rated as problematic. This issue affects an unknown part of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs administrator credentials. This vulnerability affects Cisco DNA Center Software releases earlier than 1.3.0.6 and 1.3.1.4.

The weakness was published 02/05/2020 as cisco-sa-20190205-dnac-xss as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2019-15253 since 08/20/2019. The attack may be initiated remotely. A simple authentication is necessary for exploitation. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 1.3.0.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48459). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Digital Network Architecture

Version

• 1.3.0.0
• 1.3.0.1
• 1.3.0.2
• 1.3.0.3
• 1.3.0.4
• 1.3.0.5
• 1.3.1.0
• 1.3.1.1
• 1.3.1.2
• 1.3.1.3

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion