CVE-2018-0326

A vulnerability in the web UI of Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against a user of the web UI of the affected software. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCun79565.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/104204	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040930	VDB Entry Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-telepres-xfs	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:telepresence_tx9000_firmware:10.0\(2.98000.99\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:telepresence_tx9000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-17 03:29

Updated : 2019-10-09 23:31

NVD link : CVE-2018-0326

Mitre link : CVE-2018-0326

CVE.ORG link : CVE-2018-0326

JSON object : View

Products Affected

cisco

telepresence_tx9000
telepresence_tx9000_firmware

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2018-0326", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-05-17T03:29:00.857", "references": [{"url": "http://www.securityfocus.com/bid/104204", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1040930", "tags": ["VDB Entry", "Third Party Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-telepres-xfs", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-693"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco TelePresence Server Software could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against a user of the web UI of the affected software. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCun79565."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de usuario web de Cisco TelePresence Server Software podr\u00eda permitir que un atacante remoto sin autenticar lleve a cabo un ataque de Cross-Frame Scripting (XFS) contra un usuario de la interfaz web del software afectado. Esta vulnerabilidad se debe a las protecciones insuficientes de inline frames HTML (iframes) de la interfaz web del software afectado. Un atacante podr\u00eda explotar esta vulnerabilidad persuadiendo a un usuario de la interfaz afectada para que visite una p\u00e1gina web controlada por el atacante que contenga un iframe de HTML malicioso. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante lleve a cabo el secuestro de clics u otros ataques de navegador del lado del cliente en el sistema afectado. Cisco Bug IDs: CSCun79565."}], "lastModified": "2019-10-09T23:31:46.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:telepresence_tx9000_firmware:10.0\\(2.98000.99\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD3A518F-49F2-4D68-8B23-39486220416F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:telepresence_tx9000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "41723BED-C408-4091-B910-C6DF2DD71523"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}