CVE-2015-6374

{"id": "CVE-2015-6374", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-11-19T02:59:06.317", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151117-firepower4", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604."}, {"lang": "es", "value": "La interfaz web en Cisco Firepower Extensible Operating System 1.1(1.160) en dispositivos Firepower 9000 no restringe adecuadamente el uso de elementos IFRAME, lo que hace m\u00e1s f\u00e1cil para atacantes remotos llevar a cabo ataques de secuestro de clic y otros ataques no especificados a trav\u00e9s de una p\u00e1gina web manipulada, tambi\u00e9n conocida como Bug ID CSCux10604."}], "lastModified": "2015-11-19T17:19:58.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:firepower_extensible_operating_system:1.1\\(1.160\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B9E0CD4-B484-4323-AC1D-A0817F0F8C49"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}