PT-2023-1324 · Cisco · Cisco Prime Infrastructure

Published 2023-02-01 · Updated 2023-04-11 · CVE-2023-20068

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure Software (affected versions not specified)

Description The issue is related to insufficient protection of the web page structure in the Cisco Prime Infrastructure system, allowing an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface on an affected device. This is due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-00614

CVE-2023-20068

Affected Products

Cisco Prime Infrastructure

References · 10

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-xss-PU6dnfD9?emailclick=CNSemail · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-xss-PU6dnfD9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20068 · Security Note
• https://bdu.fstec.ru/vul/2023-00614 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20068 · Vendor Advisory
• https://t.me/cvenotify/47614 · Telegram Post
• https://t.me/cvenotify/48038 · Telegram Post
• https://vuldb.com/ru/?id.219992 · Note
• https://t.me/cibsecurity/61482 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023020154 · Note