Cisco Online Help System Cross-Site Scripting Vulnerability

Multiple Cisco products contain a vulnerability in the Online Help System that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.

This vulnerability exists because the search feature of the web-based Online Help System interface fails to sufficiently filter user-supplied input. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to follow a crafted link. This action could allow the attacker to execute arbitrary code in a user’s browser in the context of the affected site. An exploit could allow the attacker to access sensitive browser information or take actions on the affected site as the targeted user.

Cisco confirmed this vulnerability in a security response and issued
approved workarounds.

Attackers cannot exploit this vulnerability directly; instead, they must convince a user to follow a crafted link. An exploit could allow the attacker to execute arbitrary script code in the context of the affected site, which may permit the attacker to access confidential browser information or take actions on the affected site as the user. In some related applications, an attacker may make configuration changes on an affected system with the privileges of the targeted user. This vector may require a targeted user to authenticate to an administration interface before an exploit can occur.

Because many of the affected products may be considered valuable assets, this vulnerability could draw the attention of attackers that are invested in corporate
espionage. The ability to access a competitor’s datastream, network, or VoIP telephone system are choice outcomes for individuals that deal in stolen information.

Administrators are strongly encouraged not to follow unsolicited links while performing maintenance tasks on any of the affected systems. Administrators should also ensure that they log out after the completion of an administration session to ensure that valid authentication cookies do not remain on administrator workstations.