PT-2023-1369 · Cisco · Cisco Broadworks Application Delivery Platform+2

Published

2023-01-11

·

Updated

2024-01-25

·

CVE-2023-20019

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Cisco BroadWorks Application Server (affected versions not specified) Cisco BroadWorks Xtended Services Platform (affected versions not specified) Cisco BroadWorks Application Delivery Platform (affected versions not specified)
Description The issue exists due to insufficient protection of the web page structure in the web-based management interface. This could allow a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is caused by the interface not properly validating user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information.
Recommendations For Cisco BroadWorks Application Server, update to a version that properly validates user-supplied input. For Cisco BroadWorks Xtended Services Platform, ensure the web-based management interface is configured to validate user input correctly. For Cisco BroadWorks Application Delivery Platform, consider implementing additional validation for user-supplied input in the web-based management interface as a temporary workaround until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-00713
CVE-2023-20019

Affected Products

Cisco Broadworks Application Delivery Platform
Cisco Broadworks Application Server
Cisco Broadworks Xtended Services Platform