PT-2023-1324 · Cisco · Cisco Prime Infrastructure

Publicado 2023-02-01 · Atualizado 2023-04-11 · CVE-2023-20068

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure Software (affected versions not specified)

Description The issue is related to insufficient protection of the web page structure in the Cisco Prime Infrastructure system, allowing an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface on an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-00614

CVE-2023-20068

Produtos afetados

Cisco Prime Infrastructure

Referências · 10

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-xss-PU6dnfD9?emailclick=CNSemail · Aviso do Fabricante
• https://t.me/cvenotify/47614 · Publicação no Telegram
• https://t.me/cvenotify/48038 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-xss-PU6dnfD9 · Aviso do Fabricante
• https://vuldb.com/ru/?id.219992 · Nota
• https://t.me/cibsecurity/61482 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20068 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023020154 · Nota
• https://bdu.fstec.ru/vul/2023-00614 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20068 · Aviso do Fabricante