What is the CVSS score of CVE-2019-12718?

CVE-2019-12718 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.8%.

Sf250 24 Firmware CVE-2019-12718

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2019-10-16 psirt@cisco.com

XSS Cisco Sf250 24 Firmware Sf250 24P Firmware Sf250 48 Firmware Sf250 48Hp Firmware Sf250 08 Firmware Sf250 08Hp Firmware Sf250 10P Firmware Sf250 18 Firmware Sf250 26 Firmware Sf250 26Hp Firmware Sf250 26P Firmware Sf250 50 Firmware Sf250 50Hp Firmware Sf250 50P Firmware Sf250X 24 Firmware Sf250X 24P Firmware Sf250X 48 Firmware Sf250X 48P Firmware Sg350 10 Firmware Sg350 10P Firmware Sg350 10Mp Firmware Sg355 10P Firmware Sg350 28 Firmware Sg350 28P Firmware Sg350 28Mp Firmware Sf350 48 Firmware Sf350 48P Firmware Sf350 48Mp Firmware Sx550X 16Ft Firmware Sx550X 24Ft Firmware Sx550X 12F Firmware Sx550X 24F Firmware Sx550X 24 Firmware Sx550X 52 Firmware Sg550X 24 Firmware Sg550X 24P Firmware Sg550X 24Mp Firmware Sg550X 24Mpp Firmware Sg550X 48 Firmware Sg550X 48P Firmware Sg550X 48Mp Firmware Sf550X 24 Firmware Sf550X 24P Firmware Sf550X 24Mp Firmware Sf550X 48 Firmware Sf550X 48P Firmware Sf550X 48Mp Firmware Sf200 24 Firmware Sf200 24Fp Firmware Sf200 24P Firmware Sf200 48 Firmware Sf200 48P Firmware Sf200E 24 Firmware Sf200E 24P Firmware Sf200E 48 Firmware Sf200E48P Firmware Sg200 08 Firmware Sg200 08P Firmware Sg200 10Fp Firmware Sg200 18 Firmware Sg200 26 Firmware Sg200 26Fp Firmware Sg200 26P Firmware Sg200 50 Firmware Sg200 50Fp Firmware Sg200 50P Firmware Sf302 08Pp Firmware Sf302 08Mpp Firmware Sg300 10Pp Firmware Sg300 10Mpp Firmware Sf300 24Pp Firmware Sf300 48Pp Firmware Sg300 28Pp Firmware Sf300 08 Firmware Sf300 48P Firmware Sg300 10Mp Firmware Sg300 10P Firmware Sg300 10 Firmware Sg300 28P Firmware Sf300 24P Firmware Sf302 08Mp Firmware Sg300 28 Firmware Sf300 48 Firmware Sg300 20 Firmware Sf302 08P Firmware Sg300 52 Firmware Sf300 24 Firmware Sf302 08 Firmware Sf300 24Mp Firmware Sg300 10Sfp Firmware Sg300 28Mp Firmware Sg300 52P Firmware Sg300 52Mp Firmware Sg500 28Mpp Firmware Sg500 52Mp Firmware Sg500Xg 8F8T Firmware Sf500 24 Firmware Sf500 24P Firmware Sf500 48 Firmware Sf500 48P Firmware Sg500 28 Firmware Sg500 28P Firmware Sg500 52 Firmware Sg500 52P Firmware Sg500X 24 Firmware Sg500X 24P Firmware Sg500X 48 Firmware Sg500X 48P Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Oct 16, 2019 - 19:15 nvd

MEDIUM 6.1

DescriptionNVD

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

AnalysisAI

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Affected products include: Cisco Sf250-24 Firmware, Cisco Sf250-24P Firmware, Cisco Sf250-48 Firmware, Cisco Sf250-48Hp Firmware, Cisco Sf250-08 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.