CVE-2016-6395 (GCVE-0-2016-6395)
Vulnerability from cvelistv5
Published
2016-09-12 10:00
Modified
2024-08-06 01:29
Severity ?
CWE
  • n/a
Summary
Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:29:19.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1036755",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036755"
          },
          {
            "name": "92824",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92824"
          },
          {
            "name": "20160907 Cisco Firepower Management Center and FireSIGHT System Software Cross-Site Scripting Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T20:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1036755",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036755"
        },
        {
          "name": "92824",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92824"
        },
        {
          "name": "20160907 Cisco Firepower Management Center and FireSIGHT System Software Cross-Site Scripting Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2016-6395",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1036755",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036755"
            },
            {
              "name": "92824",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92824"
            },
            {
              "name": "20160907 Cisco Firepower Management Center and FireSIGHT System Software Cross-Site Scripting Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2016-6395",
    "datePublished": "2016-09-12T10:00:00",
    "dateReserved": "2016-07-26T00:00:00",
    "dateUpdated": "2024-08-06T01:29:19.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-6395\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2016-09-12T10:59:08.227\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Management Center before 6.1 and FireSIGHT System Software before 6.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz58658.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en la interfaz de administraci\u00f3n basada en web en Cisco Firepower Management Center en versiones anteriores a 6.1 y FireSIGHT System Software en versiones anteriores a 6.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una URL manipulada, vulnerabilidad tambi\u00e9n conocida como Bug ID CSCuz58658.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D68F137F-0C21-4426-A9AC-B9B00177F7B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4874DD2C-25A3-4A5D-B27C-02C8D990868E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7317F08D-7EFC-4B62-80F7-FE576231A18E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7508F7DB-48D1-4193-ABED-DCA6C49B11B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF592298-E703-4B5F-988A-FA1C0E342A1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"089D6811-105D-4ECA-8836-F46BD0C7EDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28E65D89-AFF5-47B7-91EE-2A40CB01A689\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"751A22BC-528B-4491-8BDE-F5E3DC024D85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC7B8C63-652A-48CE-B13B-D01E53B3FC49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C3E9B49-3332-4D5C-8E2E-4E3BEC0846C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"886ABEA0-A578-4239-9058-E51688D8027B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"758C985B-8BD7-48F0-99B3-AE06BAEB0EE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3F035955-83F7-4BAF-AA3D-3813C8AA4C22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5815516B-6CC1-4951-953B-4F6B438269E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.1.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C30E53-E9AE-4517-AC5C-EC5ED8668380\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCC4B09D-E3B2-40B2-8704-010EDF605675\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E807F3A-A75F-43F6-8CFC-92200D0F0C16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5025E5E-51CD-42B9-B81A-15B06BEBB514\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4023BBD2-FF31-402B-BBB2-DD143CF574EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1252AB9E-CF16-4721-BAD8-55B761303164\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB7B2163-041D-4975-8B00-A406F47EEB9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55200C11-D3AB-4E4E-AE45-4D27AEDB23E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEEF2BDF-612C-4B37-8FE2-AD3191D417EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1049BCE-4A7B-4636-9090-17724D5AFBA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87359216-7FDC-4235-9DEC-6BAF04214FC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C5912CE-A631-4A16-84EE-E7B9864655D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11825DC6-C51C-49DA-9F60-BA60E2FBD2E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D75EF46F-C78B-4D96-AEDD-C66EC5A414D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E708B7E-F5AA-4DD8-90DD-76D107F2AC17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36FB1681-0566-4BC5-94A4-1D9AA58E222F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA95F020-BD8E-4188-8ABF-7310300B1763\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BEF2B98-243F-4796-A98C-A978C4CCAD91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A9002E-66A1-4C35-8D07-9BC438350081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34C49E27-A356-45E5-9FF3-242C37626718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1B9FBE0-7771-49C9-96D9-204B684AB693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"380900BB-4F03-4E76-A78C-DFB43669494F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5273EE5-40CA-48B5-8F60-823CDB75F3A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.3.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A476BF5E-1877-4B47-8E89-240910B49A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EB13B96-D431-49BD-ADAB-9AE5DB559935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79AECC9E-657F-4BFF-B640-B96CD1384647\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2424A93-0C9D-4839-9773-EBFD143F6240\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C27E220F-160C-4706-9516-27889F7B37E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CB0484C-F0B7-4349-856E-194E97A7F8A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD5721D-8F28-4A7C-B2BE-97CE796B208A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85DEC2B7-2142-4959-817F-2F9B3AA82660\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7DC251B-1CA8-4232-A900-885933E01FB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD0DF530-4865-45A1-87CA-6ED6026A56A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7335266F-B16F-4EFB-B1D2-1F61B3EBB437\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:5.4.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13BF9C6F-B511-444B-B6B7-960DF8758964\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55D52DB0-4441-41C9-900E-DE917B0CBC91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:6.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D032900-6B00-4F4D-A2F7-6119F113675F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:firesight_system_software:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC5565FE-174C-41C7-9462-9138BB31507D\"}]}]}],\"references\":[{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92824\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://www.securitytracker.com/id/1036755\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160907-fsss\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92824\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1036755\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.