CVE-2014-3408
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Prime Optical 10 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq80763.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@cisco.com — http://tools.cisco.com/security/center/viewAlert.x?alertId=36099
Vendor advisory: psirt@cisco.com — http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3408
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| cisco | prime_optical | 10.0 | |
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3408
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36099
- http://www.securityfocus.com/bid/70594
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3408
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36099
- http://www.securityfocus.com/bid/70594
CWEs
CWE-79
Verify integrity in audit chain (admin only). AS-IS.