Summary
Name: Cross Site Scripting in CiscoWorks
Release Date: 05 December 2007
Reference: LSD001-2007
Discover: Dave Lewis
CVE Number: CVE-2007-5582
Vendor: Cisco
Systems Affected: CiscoWorks version 2.6 (as tested)
All prior builds are affected
Risk: Medium
Status: Published (Vendor Confirmed, Patch Available)
Description
The initial CiscoWorks login page is susceptible to XSS attack.
Impact: attackers could execute XSS attacks that can harvest session cookies and username/passwords.
TimeLine
Discovered: 20 August 2007
Reported: 24 September 2007
Fixed: 5 November 2007
Patch Release: 5 December 2007
Published: 5 December 2007
Technical Details
The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the request. Input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session.
Fix Information
This issue has now been resolved.
The patch may be obtained from:
http://www.cisco.com
Cisco Advisory
http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml
I would like to thank Cisco for their prompt and professional response to this issue.
Liquidmatrix Security Digest
2255B Queen Street East
suite 156
Toronto, Ontario
Canada
M4E 1G3
Thanks: PortSwigger, Wade and pdp.