PT-2022-1428 · Cisco · Cisco Ece

Published

2022-01-12

·

Updated

2024-11-18

·

CVE-2022-20632

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Cisco ECE (affected versions not specified)
Description A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
Recommendations For all affected versions, update to the latest software version released by Cisco, as they have released software updates that address this vulnerability. At the moment, there is no information about specific workarounds that address this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-00531
CVE-2022-20632

Affected Products

Cisco Ece