CVE-2012-6029
Cisco NAC Appliance < 4.9.2 - Cross-Site Scripting via Web Authentication Parameters
Title source: llmDescription
Multiple cross-site scripting (XSS) vulnerabilities in the web-authentication function on the Cisco NAC Appliance 4.9.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) cm or (2) uri parameters to (a) perfigo_weblogin.jsp, or the (3) cm, (4) provider, (5) session, (6) uri, (7) userip, or (8) username parameters to (b) perfigo_cm_validate.jsp, aka Bug ID CSCud15109.
References (2)
Core 2
Core References
Various Sources x_refsource_misc
http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2013-001/
Vendor Advisory vendor-advisory
x_refsource_cisco
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6029
Scores
EPSS
0.0097
EPSS Percentile
58.1%
Details
CWE
CWE-79
Status
published
Products (11)
cisco/nac_appliance
cisco/nac_appliance
3.6
cisco/nac_appliance
4.0
cisco/nac_appliance
4.1
cisco/nac_appliance
4.5
cisco/nac_appliance
4.6
cisco/nac_appliance
4.7
cisco/nac_appliance
4.7.1
cisco/nac_appliance
4.7.2
cisco/nac_appliance
4.8
... and 1 more
Published
Jan 31, 2013
Tracked Since
Feb 18, 2026