PT-2022-1442 · Cisco · Cisco Secure Network Analytics+1

Alexander Barakazian · Published 2022-01-12 · Updated 2022-01-20 · CVE-2022-20647

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Security Manager (affected versions not specified) Cisco Secure Network Analytics (affected versions not specified)

Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, which could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. This can be achieved by persuading a user to click a crafted link, potentially allowing the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. The vulnerability is also associated with inadequate protection of the web page structure.

Recommendations For Cisco Security Manager, consider restricting access to the web-based management interface until a fix is available. For Cisco Secure Network Analytics, as a temporary workaround, consider disabling the web-based interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-00545

CVE-2022-20647

Affected Products

Cisco Secure Network Analytics

Cisco Security Manager

References · 6

• https://bdu.fstec.ru/vul/2022-00545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-20647 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-mult-xss-7hmOKQTt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20647 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022012412 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-xss-NXOxDhRQ · Note