Lucene search

CiscoCVE-2016-6404

HistorySep 18, 2016 - 10:59 p.m.

CVE-2016-6404

2016-09-1822:59:13

CWE-79

cisco

web.nvd.nist.gov

cve-2016-6404

cross-site scripting

xss

cisco

iox local manager

ios

vulnerability

web framework

remote attackers

arbitrary web script

html

crafted url

bug id

cscuy19854

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

55.7%

JSON

Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854.

Affected configurations

Nvd

Node

ciscoiosMatch15.5\(2\)t

VendorProductVersionCPE
ciscoios15.5(2)tcpe:2.3:o:cisco:ios:15.5\(2\)t:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios	15.5(2)t	cpe:2.3:o:cisco:ios:15.5\(2\)t:::::::*

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-ios

www.securityfocus.com/bid/92963

www.securitytracker.com/id/1036834

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

55.7%

JSON

Related for CVE-2016-6404