Vulnslist

Cisco product, release, and evidence lookup

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

cisco-sa-20160803-cpi · Medium · Published · Updated

Data: Cisco advisories · Cisco CSAF · NVD CVEs · NVD CPEs · CISA KEV · EPSS

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. An exploit could allow the attacker to conduct clickjacking or other client-side browser attacks. Cisco has not released software updates that address this vulnerability. Workarounds that address this vulnerability are not available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160803-cpi

Cisco advisory ·CSAF JSON

Workarounds

Workarounds that address this vulnerability are not available.

CVEsCVE-2016-1474
Cisco Bug IDsCSCuw65846
CVSS ScoreBase 4.3
Base 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N/E:F/RL:U/RC:C

Products with public affected evidence

Product CVE Affected evidence
Cisco Prime Infrastructure CVE-2016-1474 structured affected CSAF product_status