1. Home
  2. CVE Database
  3. CVE-2019-12718
MEDIUM · 6.1

CVE-2019-12718

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a u...

Vulnerability Description

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
CiscoSf250-24 Firmware< 2.5.0.90
CiscoSf250-24-
CiscoSf250-24P Firmware< 2.5.0.90
CiscoSf250-24P-
CiscoSf250-48 Firmware< 2.5.0.90
CiscoSf250-48-
CiscoSf250-48Hp Firmware< 2.5.0.90
CiscoSf250-48Hp-
CiscoSf250-08 Firmware< 2.5.0.90
CiscoSf250-08-
CiscoSf250-08Hp Firmware< 2.5.0.90
CiscoSf250-08Hp-
CiscoSf250-10P Firmware< 2.5.0.90
CiscoSf250-10P-
CiscoSf250-18 Firmware< 2.5.0.90
CiscoSf250-18-
CiscoSf250-26 Firmware< 2.5.0.90
CiscoSf250-26-
CiscoSf250-26Hp Firmware< 2.5.0.90
CiscoSf250-26Hp-

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2019-12718?

CVE-2019-12718 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a u...

How severe is CVE-2019-12718?

CVE-2019-12718 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-12718?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sf250-24 Firmware, Cisco Sf250-24, Cisco Sf250-24P Firmware, Cisco Sf250-24P, Cisco Sf250-48 Firmware.