8.8

CVE-2019-12624

Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Ios Xe Version >= 3.0.xe <= 3.11.xe
   Cisco ≫ 5760 Wireless Lan Controller Version -
   Cisco ≫ Catalyst 3650-12x48uq Version -
   Cisco ≫ Catalyst 3650-12x48ur Version -
   Cisco ≫ Catalyst 3650-12x48uz Version -
   Cisco ≫ Catalyst 3650-24pd Version -
   Cisco ≫ Catalyst 3650-24pdm Version -
   Cisco ≫ Catalyst 3650-48fq Version -
   Cisco ≫ Catalyst 3650-48fqm Version -
   Cisco ≫ Catalyst 3650-8x24uq Version -
   Cisco ≫ Catalyst 3850-12x48u Version -
   Cisco ≫ Catalyst 3850-24u Version -
   Cisco ≫ Catalyst 3850-24xs Version -
   Cisco ≫ Catalyst 3850-24xu Version -
   Cisco ≫ Catalyst 3850-48u Version -
   Cisco ≫ Catalyst 3850-48xs Version -
   Cisco ≫ Catalyst 3850-nm-2-40g Version -
   Cisco ≫ Catalyst 3850-nm-8-10g Version -
   Cisco ≫ Catalyst 4500e Supervisor Engine 8-e Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 18.19% 0.969
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Cisco PSIRT 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-iosxe-ngwc-csrf
Vendor Advisory