Cisco Secure Access Control System (ACS) Multiple Vulnerabilities

medium Nessus Plugin ID 69853

Synopsis

The remote host has a web application installed that is affected by multiple vulnerabilities.

Description

The version of Cisco Secure Access Control System installed on the remote host is potentially affected by multiple vulnerabilities :

- An unspecified cross-site scripting vulnerability exists in the web interface. (CVE-2013-3423)

- An unspecified cross-site request forgery vulnerability exists in the Admin/View Page. (CVE-2013-3424)

Solution

Upgrade to Cisco Access Control System 5.3(0.40.9) / 5.4(0.46.3) or later.

See Also

http://www.nessus.org/u?979c1d05

http://www.nessus.org/u?b9d5ff74

https://tools.cisco.com/security/center/viewAlert.x?alertId=30076

Plugin Details

Severity: Medium

ID: 69853

File Name: cisco_acs_multiple_xss.nasl

Version: 1.6

Type: local

Family: CISCO

Published: 9/12/2013

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:cisco:secure_access_control_system

Required KB Items: Host/Cisco/ACS

Exploit Ease: No known exploits are available

Patch Publication Date: 7/12/2013

Vulnerability Publication Date: 7/12/2013

Reference Information

CVE: CVE-2013-3423, CVE-2013-3424

BID: 61173, 61175

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990

CISCO-BUG-ID: CSCud75174, CSCud75177