ESB-2017.2950 - [Virtual][Cisco] Cisco Registered Envelope Service: Cross-site scripting - Remote with user interaction 2017-11-17

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.2950
          Cisco Registered Envelope Service: Cross-site Scripting
                             17 November 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Cisco Registered Envelope Service
Publisher:         Cisco Systems
Operating System:  Cisco
                   Virtualisation
Impact/Access:     Cross-site Scripting -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-12323 CVE-2017-12322 CVE-2017-12321
                   CVE-2017-12320 CVE-2017-12292 CVE-2017-12291
                   CVE-2017-12290  

Original Bulletin: 
   https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-res

- --------------------------BEGIN INCLUDED TEXT--------------------

Cisco Registered Envelope Service Cross-Site Scripting Vulnerabilities

Severity: Medium
Advisory ID: cisco-sa-20171115-res
First Published: 2017 November 15 16:00  GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCve77195 CSCve90978 CSCvf42310 CSCve77195 CSCve90978
	       CSCvf42310 CSCvf42703 CSCvf42723 CSCvf46169 CSCvf49999

CVE-2017-12290 CVE-2017-12291 CVE-2017-12292 CVE-2017-12290 CVE-2017-12291
CVE-2017-12292 CVE-2017-12320 CVE-2017-12321 CVE-2017-12322 CVE-2017-12323
CWE-79

CVSS Score:
Base 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X

Summary

  * Multiple vulnerabilities in the web interface of the Cisco Registered
    Envelope Service could allow an unauthenticated, remote attacker to conduct
    a cross-site scripting (XSS) attack or redirect a user of the affected
    service to an undesired web page.

    The vulnerabilities are due to insufficient validation of user-supplied
    input by the web-based management interface of the affected service. An
    attacker could exploit these vulnerabilities by persuading a user to click
    a malicious link or by sending an HTTP request that could cause the
    affected service to redirect the request to a specified malicious URL. A
    successful exploit could allow the attacker to execute arbitrary script
    code in the context of the web interface of the affected system or allow
    the attacker to access sensitive browser-based information on the affected
    system. These types of exploits could also be used in phishing attacks that
    send users to malicious websites without their knowledge.

    There are no workarounds that address these vulnerabilities.

    For additional information about cross-site scripting attacks and the
    methods used to exploit these vulnerabilities, see the following resources:
      + Cisco Applied Mitigation Bulletin: Understanding Cross-Site Scripting
        (XSS) Threat Vectors
      + OWASP reference: Cross-Site Scripting (XSS)
      + CWE definition: CWE-79: Improper Neutralization of Input During Web
        Page Generation
      + CWE definition: CWE-601: URL Redirection to Untrusted Site
    This advisory is available at the following link:
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-20171115-res

Affected Products

  * Vulnerable Products

    These vulnerabilities affect the Cisco Registered Envelope Service, which
    is cloud based.

    For information about affected software releases, consult the Cisco bug ID
    (s) at the top of this advisory.

    Products Confirmed Not Vulnerable

    No other Cisco products are currently known to be affected by these
    vulnerabilities.

Workarounds

  * There are no workarounds that address these vulnerabilities.

Fixed Software

  * At the time of publication, fixed software had been provided to the Cisco
    Registered Envelope Service for these vulnerabilities. For the latest and
    most detailed information about fixed software releases, consult the Cisco
    bug ID(s) at the top of this advisory.

Exploitation and Public Announcements

  * The Cisco Product Security Incident Response Team (PSIRT) is not aware of
    any public announcements or malicious use of the vulnerabilities that are
    described in this advisory.

Source

  * Cisco would like to thank independent researcher userburden and security
    researcher Rahul Raj for finding and reporting these vulnerabilities.
Subscribe to Cisco Security Notifications

URL

  * https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
    cisco-sa-20171115-res

- -------------------------------------------------------------------------------

Legal Disclaimer

  * THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND
    OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR
    FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT
    OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES
    THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

    A standalone copy or paraphrase of the text of this document that omits the
    distribution URL is an uncontrolled copy and may lack important information
    or contain factual errors. The information in this document is intended for
    end users of Cisco products.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWg5pe4x+lLeg9Ub1AQgqXRAAmYkMJQ4KrPPzwybvnLf0fPO1lKY92aTg
sey4nmye93koX1i7HLn38ZEg8scvZQ47aYjC2wFpEFevQQvSeSjhX8R1a8kdvPWD
mH2Zj8crNtfGyfFDhNnfbXpiD0TZ1nFe/ykJZpT7uvbGT9cLy75cVCeug/lhXsJz
+nLBf4XWMihht7xEoOTZV8HTqI+QTnA0htwQhzPFEzpewT6neVCdoTmj1nnv8enX
ntHX5nT1ko56GkiNASiAZCfy2SsMw26n0cPaRhvugWQ+1wHEpALrK1PHQYiNNPOo
i1yln7/LPrGTXDp3tS58hAoN/qig7OcPiptcbHfhvoRXaFkaam8OMIdHhuBRJoYB
mrDEnOxNlFWhAwsm+7XeXaWEo0DV8jl6E12i7lThto/S8HW6Ow+Ez8PlYtszX6Gm
UrYdEATARu0YRAMyJrFQn/rIOO2OwmN0UgVvmvo2WNBBEqw7STIlHrLmIkXwMDpR
L2ikoQ91CbfWyfJnyFlbcW1HYJb3kn987EPkghEF7r988Pau757II0a7C6ga9MeJ
fdVqg0um0CrnAnEUY6fpTe7OumY6LYW+Jz7sa8Rq0ekwHvl85Gf9aERW9oCT3Zi1
FXOomyptO5hUIVu/ZRkWySgfBf9qevLh/nRLDOGdI8B4aYzE2RE3kTcFa/9reMyA
XLPbJpxpekA=
=EX+I
-----END PGP SIGNATURE-----

« Back to bulletins