Cisco APIC Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the web UI of Cisco Application Policy Infrastructure Controller (APIC). This vulnerability allows an authenticated, remote attacker to inject malicious code into specific pages of the web UI. The issue arises from improper input validation, which could enable the execution of arbitrary script code in the context of the web UI or access to sensitive, browser-based information.

Impact

Exploitation of this vulnerability could lead to a stored cross-site scripting condition, allowing injected scripts to be executed in the context of the user's session.

Remediation

Cisco has released software updates to address this vulnerability. Users are advised to upgrade to version 6.0(8e) or 6.1(2f). For versions prior to 6.0, users should migrate to a fixed release.