Home

CVE-2017-12304

Description

A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the web-based management interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf60862.

Risk Information

Base Score
6.1
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
Exploitation Probability
0.17

Associated Vulnerability

VulnerabilityOS Platform
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco ASR 1000 Series Aggregation Services RoutersNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Cloud Services Router 1000V SeriesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 3850 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 3650 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco 4000 Series Integrated Services RoutersNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco 1000 Series Integrated Services RoutersNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9300 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9500 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9400 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco 1100 Series Industrial Integrated Services RoutersNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9200 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9600 Series SwitchesNCM
Cisco IOS and IOS XE Software IOS daemon Cross-Site Scripting Vulnerability For Cisco Catalyst 9800 Series Wireless ControllersNCM
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability (CVE-2017-12304)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-1705898Security Update for Cisco ASR 1000 Series Aggregation Services Routers Denali-16.3.4a
PATCH-1705899Security Update for Cisco Cloud Services Router 1000V Series Denali-16.3.4a
PATCH-1705900Security Update for Cisco Catalyst 3850 Series Switches Denali-16.3.4a
PATCH-1705832Security Update for Cisco Catalyst 3650 Series Switches Everest-16.5.1
PATCH-1705901Security Update for Cisco 4000 Series Integrated Services Routers Denali-16.3.4a
PATCH-1705902Security Update for Cisco 1000 Series Integrated Services Routers Denali-16.3.4a
PATCH-1705903Security Update for Cisco Catalyst 9300 Series Switches Denali-16.3.4a
PATCH-1705904Security Update for Cisco Catalyst 9500 Series Switches Denali-16.3.4a
PATCH-1705905Security Update for Cisco Catalyst 9400 Series Switches Denali-16.3.4a
PATCH-1705906Security Update for Cisco 1100 Series Industrial Integrated Services Routers Denali-16.3.4a
PATCH-1705907Security Update for Cisco Catalyst 9200 Series Switches Denali-16.3.4a
PATCH-1705908Security Update for Cisco Catalyst 9600 Series Switches Denali-16.3.4a
PATCH-1705909Security Update for Cisco Catalyst 9800 Series Wireless Controllers Denali-16.3.4a

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234