Cisco Vision Dynamic Signage Director up to 6.2 SP4 Stored cross site scripting

Summaryinfo

A vulnerability was found in Cisco Vision Dynamic Signage Director up to 6.2 SP4. It has been rated as problematic. The affected element is an unknown function. This manipulation causes cross site scripting (Stored). This vulnerability is handled as CVE-2020-3491. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Vision Dynamic Signage Director up to 6.2 SP4. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have administrative privileges on the affected device.

The weakness was released 08/19/2020 as cisco-sa-cvdsd-xss-teMmLyUr as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2020-3491. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Applying the patch 6.2 SP5 is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-160113 and VDB-160108. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Vision Dynamic Signage Director

Version

• 6.2 SP4

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion