cve-2023-20205
Vulnerability from cvelistv5
Published
2023-08-16 21:38
Modified
2024-08-02 09:05
Severity ?
EPSS score ?
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device.
These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid credentials to access the web-based management interface of the affected device.
References
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | Cisco | Cisco Prime Infrastructure |
Version: 2.0.0 Version: 2.0.10 Version: 2.0.39 Version: 2.1.0 Version: 2.1.1 Version: 2.1.2 Version: 2.1.56 Version: 2.2.0 Version: 2.2.1 Version: 2.2.2 Version: 2.2.3 Version: 2.2.10 Version: 2.2.8 Version: 2.2.4 Version: 2.2.7 Version: 2.2.5 Version: 2.2.9 Version: 2.2.1 Update 01 Version: 2.2.2 Update 03 Version: 2.2.2 Update 04 Version: 2.2.3 Update 02 Version: 2.2.3 Update 03 Version: 2.2.3 Update 04 Version: 2.2.3 Update 05 Version: 2.2.3 Update 06 Version: 3.0.0 Version: 3.0.1 Version: 3.0.2 Version: 3.0.3 Version: 3.0.4 Version: 3.0.6 Version: 3.0.5 Version: 3.0.7 Version: 3.1.0 Version: 3.1.1 Version: 3.1.7 Version: 3.1.5 Version: 3.1.2 Version: 3.1.3 Version: 3.1.4 Version: 3.1.6 Version: 3.2.2 Version: 3.2.0-FIPS Version: 3.2.1 Version: 3.3.0 Version: 3.3.1 Version: 3.3.0 Update 01 Version: 3.4.0 Version: 3.4.1 Version: 3.4.2 Version: 3.4.1 Update 01 Version: 3.4.1 Update 02 Version: 3.4.2 Update 01 Version: 3.5.0 Version: 3.5.1 Version: 3.5.0 Update 01 Version: 3.5.0 Update 02 Version: 3.5.0 Update 03 Version: 3.5.1 Update 01 Version: 3.5.1 Update 02 Version: 3.5.1 Update 03 Version: 3.6.0 Version: 3.6.0 Update 01 Version: 3.6.0 Update 02 Version: 3.6.0 Update 03 Version: 3.6.0 Update 04 Version: 2.1 Version: 2.2 Version: 3.2 Version: 3.4_DP1 Version: 3.4_DP3 Version: 3.4_DP2 Version: 3.5_DP1 Version: 3.4_DP7 Version: 3.4_DP10 Version: 3.4_DP5 Version: 3.1_DP15 Version: 3.4_DP11 Version: 3.4_DP8 Version: 3.7_DP1 Version: 3.3_DP4 Version: 3.10_DP1 Version: 3.8_DP1 Version: 3.7_DP2 Version: 3.6_DP1 Version: 3.1_DP16 Version: 3.5_DP4 Version: 3.3_DP3 Version: 3.2_DP2 Version: 3.4_DP4 Version: 3.1_DP14 Version: 3.1_DP6 Version: 3.1_DP9 Version: 3.4_DP6 Version: 3.2_DP3 Version: 3.4_DP9 Version: 3.3_DP2 Version: 3.2_DP1 Version: 3.1_DP10 Version: 3.9_DP1 Version: 3.3_DP1 Version: 3.1_DP13 Version: 3.5_DP2 Version: 3.1_DP12 Version: 3.1_DP4 Version: 3.5_DP3 Version: 3.1_DP8 Version: 3.1_DP7 Version: 3.2_DP4 Version: 3.1_DP11 Version: 3.1_DP5 Version: 3.7.0 Version: 3.7.1 Version: 3.7.1 Update 04 Version: 3.7.1 Update 06 Version: 3.7.1 Update 07 Version: 3.7.1 Update 03 Version: 3.7.0 Update 03 Version: 3.7.1 Update 01 Version: 3.7.1 Update 02 Version: 3.7.1 Update 05 Version: 3.8.0 Version: 3.8.1 Version: 3.8.1 Update 02 Version: 3.8.1 Update 04 Version: 3.8.1 Update 01 Version: 3.8.1 Update 03 Version: 3.8.0 Update 01 Version: 3.8.0 Update 02 Version: 3.9.0 Version: 3.9.1 Version: 3.9.1 Update 02 Version: 3.9.1 Update 03 Version: 3.9.1 Update 01 Version: 3.9.1 Update 04 Version: 3.9.0 Update 01 Version: 3.10.0 Version: 3.10.3 Version: 3.10.1 Version: 3.10.2 Version: 3.10 Update 01 |
||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T09:05:35.372Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-pi-epnm-BFjSRJP5", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-BFjSRJP5" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco Prime Infrastructure", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "2.0.0" }, { "status": "affected", "version": "2.0.10" }, { "status": "affected", "version": "2.0.39" }, { "status": "affected", "version": "2.1.0" }, { "status": "affected", "version": "2.1.1" }, { "status": "affected", "version": "2.1.2" }, { "status": "affected", "version": "2.1.56" }, { "status": "affected", "version": "2.2.0" }, { "status": "affected", "version": "2.2.1" }, { "status": "affected", "version": "2.2.2" }, { "status": "affected", "version": "2.2.3" }, { "status": "affected", "version": "2.2.10" }, { "status": "affected", "version": "2.2.8" }, { "status": "affected", "version": "2.2.4" }, { "status": "affected", "version": "2.2.7" }, { "status": "affected", "version": "2.2.5" }, { "status": "affected", "version": "2.2.9" }, { "status": "affected", "version": "2.2.1 Update 01" }, { "status": "affected", "version": "2.2.2 Update 03" }, { "status": "affected", "version": "2.2.2 Update 04" }, { "status": "affected", "version": "2.2.3 Update 02" }, { "status": "affected", "version": "2.2.3 Update 03" }, { "status": "affected", "version": "2.2.3 Update 04" }, { "status": "affected", "version": "2.2.3 Update 05" }, { "status": "affected", "version": "2.2.3 Update 06" }, { "status": "affected", "version": "3.0.0" }, { "status": "affected", "version": "3.0.1" }, { "status": "affected", "version": "3.0.2" }, { "status": "affected", "version": "3.0.3" }, { "status": "affected", "version": "3.0.4" }, { "status": "affected", "version": "3.0.6" }, { "status": "affected", "version": "3.0.5" }, { "status": "affected", "version": "3.0.7" }, { "status": "affected", "version": "3.1.0" }, { "status": "affected", "version": "3.1.1" }, { "status": "affected", "version": "3.1.7" }, { "status": "affected", "version": "3.1.5" }, { "status": "affected", "version": "3.1.2" }, { "status": "affected", "version": "3.1.3" }, { "status": "affected", "version": "3.1.4" }, { "status": "affected", "version": "3.1.6" }, { "status": "affected", "version": "3.2.2" }, { "status": "affected", "version": "3.2.0-FIPS" }, { "status": "affected", "version": "3.2.1" }, { "status": "affected", "version": "3.3.0" }, { "status": "affected", "version": "3.3.1" }, { "status": "affected", "version": "3.3.0 Update 01" }, { "status": "affected", "version": "3.4.0" }, { "status": "affected", "version": "3.4.1" }, { "status": "affected", "version": "3.4.2" }, { "status": "affected", "version": "3.4.1 Update 01" }, { "status": "affected", "version": "3.4.1 Update 02" }, { "status": "affected", "version": "3.4.2 Update 01" }, { "status": "affected", "version": "3.5.0" }, { "status": "affected", "version": "3.5.1" }, { "status": "affected", "version": "3.5.0 Update 01" }, { "status": "affected", "version": "3.5.0 Update 02" }, { "status": "affected", "version": "3.5.0 Update 03" }, { "status": "affected", "version": "3.5.1 Update 01" }, { "status": "affected", "version": "3.5.1 Update 02" }, { "status": "affected", "version": "3.5.1 Update 03" }, { "status": "affected", "version": "3.6.0" }, { "status": "affected", "version": "3.6.0 Update 01" }, { "status": "affected", "version": "3.6.0 Update 02" }, { "status": "affected", "version": "3.6.0 Update 03" }, { "status": "affected", "version": "3.6.0 Update 04" }, { "status": "affected", "version": "2.1" }, { "status": "affected", "version": "2.2" }, { "status": "affected", "version": "3.2" }, { "status": "affected", "version": "3.4_DP1" }, { "status": "affected", "version": "3.4_DP3" }, { "status": "affected", "version": "3.4_DP2" }, { "status": "affected", "version": "3.5_DP1" }, { "status": "affected", "version": "3.4_DP7" }, { "status": "affected", "version": "3.4_DP10" }, { "status": "affected", "version": "3.4_DP5" }, { "status": "affected", "version": "3.1_DP15" }, { "status": "affected", "version": "3.4_DP11" }, { "status": "affected", "version": "3.4_DP8" }, { "status": "affected", "version": "3.7_DP1" }, { "status": "affected", "version": "3.3_DP4" }, { "status": "affected", "version": "3.10_DP1" }, { "status": "affected", "version": "3.8_DP1" }, { "status": "affected", "version": "3.7_DP2" }, { "status": "affected", "version": "3.6_DP1" }, { "status": "affected", "version": "3.1_DP16" }, { "status": "affected", "version": "3.5_DP4" }, { "status": "affected", "version": "3.3_DP3" }, { "status": "affected", "version": "3.2_DP2" }, { "status": "affected", "version": "3.4_DP4" }, { "status": "affected", "version": "3.1_DP14" }, { "status": "affected", "version": "3.1_DP6" }, { "status": "affected", "version": "3.1_DP9" }, { "status": "affected", "version": "3.4_DP6" }, { "status": "affected", "version": "3.2_DP3" }, { "status": "affected", "version": "3.4_DP9" }, { "status": "affected", "version": "3.3_DP2" }, { "status": "affected", "version": "3.2_DP1" }, { "status": "affected", "version": "3.1_DP10" }, { "status": "affected", "version": "3.9_DP1" }, { "status": "affected", "version": "3.3_DP1" }, { "status": "affected", "version": "3.1_DP13" }, { "status": "affected", "version": "3.5_DP2" }, { "status": "affected", "version": "3.1_DP12" }, { "status": "affected", "version": "3.1_DP4" }, { "status": "affected", "version": "3.5_DP3" }, { "status": "affected", "version": "3.1_DP8" }, { "status": "affected", "version": "3.1_DP7" }, { "status": "affected", "version": "3.2_DP4" }, { "status": "affected", "version": "3.1_DP11" }, { "status": "affected", "version": "3.1_DP5" }, { "status": "affected", "version": "3.7.0" }, { "status": "affected", "version": "3.7.1" }, { "status": "affected", "version": "3.7.1 Update 04" }, { "status": "affected", "version": "3.7.1 Update 06" }, { "status": "affected", "version": "3.7.1 Update 07" }, { "status": "affected", "version": "3.7.1 Update 03" }, { "status": "affected", "version": "3.7.0 Update 03" }, { "status": "affected", "version": "3.7.1 Update 01" }, { "status": "affected", "version": "3.7.1 Update 02" }, { "status": "affected", "version": "3.7.1 Update 05" }, { "status": "affected", "version": "3.8.0" }, { "status": "affected", "version": "3.8.1" }, { "status": "affected", "version": "3.8.1 Update 02" }, { "status": "affected", "version": "3.8.1 Update 04" }, { "status": "affected", "version": "3.8.1 Update 01" }, { "status": "affected", "version": "3.8.1 Update 03" }, { "status": "affected", "version": "3.8.0 Update 01" }, { "status": "affected", "version": "3.8.0 Update 02" }, { "status": "affected", "version": "3.9.0" }, { "status": "affected", "version": "3.9.1" }, { "status": "affected", "version": "3.9.1 Update 02" }, { "status": "affected", "version": "3.9.1 Update 03" }, { "status": "affected", "version": "3.9.1 Update 01" }, { "status": "affected", "version": "3.9.1 Update 04" }, { "status": "affected", "version": "3.9.0 Update 01" }, { "status": "affected", "version": "3.10.0" }, { "status": "affected", "version": "3.10.3" }, { "status": "affected", "version": "3.10.1" }, { "status": "affected", "version": "3.10.2" }, { "status": "affected", "version": "3.10 Update 01" } ] }, { "product": "Cisco Evolved Programmable Network Manager (EPNM)", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "1.2.6" }, { "status": "affected", "version": "1.2.2" }, { "status": "affected", "version": "1.2.3" }, { "status": "affected", "version": "1.2.5" }, { "status": "affected", "version": "1.2.1.2" }, { "status": "affected", "version": "1.2.4" }, { "status": "affected", "version": "1.2.7" }, { "status": "affected", "version": "1.2" }, { "status": "affected", "version": "1.2.2.4" }, { "status": "affected", "version": "1.2.4.2" }, { "status": "affected", "version": "2.0.2" }, { "status": "affected", "version": "2.0.4" }, { "status": "affected", "version": "2.0.3" }, { "status": "affected", "version": "2.0.1" }, { "status": "affected", "version": "2.0" }, { "status": "affected", "version": "2.0.1.1" }, { "status": "affected", "version": "2.0.2.1" }, { "status": "affected", "version": "2.0.4.1" }, { "status": "affected", "version": "2.0.4.2" }, { "status": "affected", "version": "2.1.2" }, { "status": "affected", "version": "2.1.3" }, { "status": "affected", "version": "2.1.1" }, { "status": "affected", "version": "2.1" }, { "status": "affected", "version": "2.1.1.1" }, { "status": "affected", "version": "2.1.1.3" }, { "status": "affected", "version": "2.1.1.4" }, { "status": "affected", "version": "2.1.2.2" }, { "status": "affected", "version": "2.1.2.3" }, { "status": "affected", "version": "2.1.3.2" }, { "status": "affected", "version": "2.1.3.3" }, { "status": "affected", "version": "2.1.3.4" }, { "status": "affected", "version": "2.1.3.5" }, { "status": "affected", "version": "2.1.4" }, { "status": "affected", "version": "2.2.1" }, { "status": "affected", "version": "2.2" }, { "status": "affected", "version": "2.2.1.1" }, { "status": "affected", "version": "2.2.1.2" }, { "status": "affected", "version": "2.2.1.3" }, { "status": "affected", "version": "2.2.1.4" }, { "status": "affected", "version": "2.2.3" }, { "status": "affected", "version": "2.2.4" }, { "status": "affected", "version": "2.2.5" }, { "status": "affected", "version": "3.0.1" }, { "status": "affected", "version": "3.0.2" }, { "status": "affected", "version": "3.0.3" }, { "status": "affected", "version": "3.0" }, { "status": "affected", "version": "3.1.1" }, { "status": "affected", "version": "3.1.2" }, { "status": "affected", "version": "3.1.3" }, { "status": "affected", "version": "3.1" }, { "status": "affected", "version": "4.1.1" }, { "status": "affected", "version": "4.1" }, { "status": "affected", "version": "4.1.1.1" }, { "status": "affected", "version": "4.1.1.2" }, { "status": "affected", "version": "4.0.3" }, { "status": "affected", "version": "4.0.1" }, { "status": "affected", "version": "4.0.2" }, { "status": "affected", "version": "4.0" }, { "status": "affected", "version": "4.0.3.1" }, { "status": "affected", "version": "5.0.1" }, { "status": "affected", "version": "5.0.2" }, { "status": "affected", "version": "5.0.2.5" }, { "status": "affected", "version": "5.0.2.3" }, { "status": "affected", "version": "5.0.2.4" }, { "status": "affected", "version": "5.0.2.1" }, { "status": "affected", "version": "5.0.2.2" }, { "status": "affected", "version": "5.0" }, { "status": "affected", "version": "5.1.1" }, { "status": "affected", "version": "5.1.2" }, { "status": "affected", "version": "5.1.3" }, { "status": "affected", "version": "5.1.4" }, { "status": "affected", "version": "5.1.4.2" }, { "status": "affected", "version": "5.1.4.1" }, { "status": "affected", "version": "5.1.4.3" }, { "status": "affected", "version": "5.1" }, { "status": "affected", "version": "5.1.3.1" }, { "status": "affected", "version": "5.1.3.2" }, { "status": "affected", "version": "7.0.0" }, { "status": "affected", "version": "6.0.0" }, { "status": "affected", "version": "6.0.2" }, { "status": "affected", "version": "6.0.1" }, { "status": "affected", "version": "6.0.2.1" }, { "status": "affected", "version": "6.0.1.1" }, { "status": "affected", "version": "6.0.3" }, { "status": "affected", "version": "6.1.1" }, { "status": "affected", "version": "6.1.1.1" }, { "status": "affected", "version": "6.1" } ] } ], "descriptions": [ { "lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device.\r\n\r These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid credentials to access the web-based management interface of the affected device." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-25T16:57:59.019Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-pi-epnm-BFjSRJP5", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-BFjSRJP5" } ], "source": { "advisory": "cisco-sa-pi-epnm-BFjSRJP5", "defects": [ "CSCwf29121", "CSCwe77122" ], "discovery": "INTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2023-20205", "datePublished": "2023-08-16T21:38:42.295Z", "dateReserved": "2022-10-27T18:47:50.367Z", "dateUpdated": "2024-08-02T09:05:35.372Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-20205\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2023-08-16T22:15:11.127\",\"lastModified\":\"2024-11-21T07:40:50.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device.\\r\\n\\r These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid credentials to access the web-based management interface of the affected device.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.1\",\"matchCriteriaId\":\"D31DFA66-3CD9-45B4-8F23-61234B50D5A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.10.4\",\"matchCriteriaId\":\"5CC17E6B-D7AB-40D7-AEC5-F5B555AC4D7F\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-BFjSRJP5\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-BFjSRJP5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.