CVE-2019-1956
Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Una vulnerabilidad en la interfaz basada en web del dispositivo SPA1122- Port Phone Adapter de Cisco, podría permitir a un atacante remoto autenticado conducir un ataque de tipo cross-site scripting (XSS) contra otro usuario del dispositivo. La vulnerabilidad es debido a una comprobación insuficiente de la entrada suministrada por el usuario mediante la interfaz basada en web del dispositivo afectado. Un atacante podría explotar esta vulnerabilidad insertando código malicioso en uno de los campos de configuración. Una explotación con éxito podría permitir al atacante ejecutar código de script arbitrario en el contexto de la interfaz afectada o acceder a información confidencial basada en el navegador.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2018-12-06 CVE Reserved
- 2019-08-08 CVE Published
- 2023-07-08 EPSS Updated
- 2024-11-21 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Spa112 2-port Phone Adapter Firmware Search vendor "Cisco" for product "Spa112 2-port Phone Adapter Firmware" | < 1.4.\(1\)sr4 Search vendor "Cisco" for product "Spa112 2-port Phone Adapter Firmware" and version " < 1.4.\(1\)sr4" | - |
Affected
| in | Cisco Search vendor "Cisco" | Spa112 2-port Phone Adapter Search vendor "Cisco" for product "Spa112 2-port Phone Adapter" | - | - |
Safe
|