cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2170
Views
0
Helpful
3
Replies

CVE-2020-11022 on WLC 8.10.130

richard.greene1
Beginner
Beginner

JQUERY <3.5

Our security team has informed us that the 3504 running 8.10.130 is showing as vulnerable for the issue identified in CVE-2020-11022

 

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

3 Replies 3

Leo Laohoo
VIP Community Legend VIP Community Legend
VIP Community Legend

From what I can read, CVE-2020-11022/CVE-2020-11023 only affects Cisco Unified Presence, UCSM and APIC. 

I don't see anything mentioning about AireOS.

Interestingly I found this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu12372
opened for CVE-2015-9251, CVE-2019-11358 but right at the end of the notes says: Related : CVE-2020-11022
I think you need to contact Cisco PSIRT or TAC to confirm whether this means AireOS is affected by CVE-2020-11022 or not (and ask them to update the bug notes to clarify).
Either way it's fixed in 8.10(139.14) so not in a public release yet and it's classified as Severity: 6 Enhancement so clearly not considered to be high risk which I guess means you can't do much harm with it on AireOS.
___________________________________________
TAC recommended codes for AireOS WLC's
Best Practices for AireOS WLC's
TAC recommended codes for 9800 WLC's
Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Recommended
WARNING - see CSCwd37092 Throughput degraded after upgrading to code 8.10.181.0/17.3.6 - 2800/3800/4800 series
- The fix for CSCwd37092 is now released in 8.10.183.0 and
- For IOS-XE 17.3.6 select controller model, go to IOS XE Software AP Service Pack, select CSCwd40096 17.3.6 APSP2
Field Notice: FN-63942 Lightweight APs and WLCs Fail to Create CAPWAP Connections Due to Certificate
                      Expiration - Software Upgrade Recommended
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
                     After 4 Dec 2022 Due to Certificate Expiration - Fixed in 8.10.183.0 and 17.3.6 APSP5 (APSP_CSCwd83653)
                     Also fixed in 8.5.182.7 (8.5 mainline) and 8.5.182.105 (8.5 IRCM) if you can't upgrade to 8.10
                     Note that 8.10.181.0 and 8.10.182.0 have been deferred (withdrawn) and are effectively unsupported by Cisco
___________________________________________
Richard R

we have the same issue on VWLC and CT2500 both with 8.5(160.0) version.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers