Description
Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13 allows remote attackers to inject arbitrary web script or HTML, possibly via the displayMsg parameter to archiveApplyDisplay.jsp, aka bug ID CSCsc01095.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cisco Wireless Lan Solution Engine - ArchiveApplyDisplay.jsp Cross-Site Scripting EDB-27684 · webapps · Apr 19, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.assurance.com.au/advisories/200604-cisco.txt
- 17604 vdb-entry
- 20060419 Multiple vulnerabilities in Linux based Cisco products mailing-list
- 19736 third-party-advisory
- 20060419 Re: Multiple vulnerabilities in Linux based Cisco products mailing-list
- ADV-2006-1434 vdb-entry
- 20060419 Multiple Vulnerabilities in the WLSE Appliance vendor-advisory
- 1015965 vdb-entry
- 24812 vdb-entry
- cisco-wlse-user-xss(25883) vdb-entry