CVE-2016-1318

Vulnerability

Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) version 1.1 is affected by a cross-site scripting (XSS) vulnerability due to insufficient input validation of user-submitted content. An attacker can inject malicious HTML or JavaScript through crafted markup data [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by crafting a request containing malicious markup and convincing a user to access a page that processes the injected data. No authentication is required, but user interaction is needed to trigger the script execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the affected web page, potentially leading to session hijacking, defacement, or theft of sensitive information [1].

Mitigation

Cisco has not released software updates to address this vulnerability as of the advisory publication date. No workarounds are available. Users should monitor Cisco's security advisories for future patches [1].