Cisco Fog Director Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Fog Director web framework could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software.

The vulnerability is due to insufficient input validation for some of the parameters that are passed to the web server. An attacker could exploit this vulnerability by persuading a user to follow a malicious link or by intercepting and injecting malicious code into a user request. A successful exploit could allow the attacker to execute arbitrary script in the context of the affected site or access sensitive browser-based information.

Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-fd[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160201-fd”]