Actu
Vigil@nce - Cisco Prime Infrastructure: Cross Site Scripting via Rogue AP SSID
June 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use a rogue SSID with a malicious SSID, to trigger
a Cross Site Scripting in Cisco Prime Infrastructure, in order to
execute JavaScript code in the context of the web site.
Impacted products: Cisco Prime
Severity: 2/4
Creation date: 31/05/2013
DESCRIPTION OF THE VULNERABILITY
The Cisco Prime Infrastructure product displays the list of rogue
access points.
The SSID of each access point is listed in a table. However, the
SSID is not filtered before being inserted in the generated
HTML/XML document.
An attacker can therefore use a rogue SSID with a malicious SSID,
to trigger a Cross Site Scripting in Cisco Prime Infrastructure,
in order to execute JavaScript code in the context of the web site.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
