8.8

CVE-2019-12624

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Xe Version >= 3.0.xe <= 3.11.xe
   Cisco ≫ 5760 Wireless Lan Controller Version-
   Cisco ≫ Catalyst 3650-12x48uq Version-
   Cisco ≫ Catalyst 3650-12x48ur Version-
   Cisco ≫ Catalyst 3650-12x48uz Version-
   Cisco ≫ Catalyst 3650-24pd Version-
   Cisco ≫ Catalyst 3650-24pdm Version-
   Cisco ≫ Catalyst 3650-48fq Version-
   Cisco ≫ Catalyst 3650-48fqm Version-
   Cisco ≫ Catalyst 3650-8x24uq Version-
   Cisco ≫ Catalyst 3850-12x48u Version-
   Cisco ≫ Catalyst 3850-24u Version-
   Cisco ≫ Catalyst 3850-24xs Version-
   Cisco ≫ Catalyst 3850-24xu Version-
   Cisco ≫ Catalyst 3850-48u Version-
   Cisco ≫ Catalyst 3850-48xs Version-
   Cisco ≫ Catalyst 3850-nm-2-40g Version-
   Cisco ≫ Catalyst 3850-nm-8-10g Version-
   Cisco ≫ Catalyst 4500e Supervisor Engine 8-e Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.81% 0.856
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
psirt@cisco.com 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.