PT-2023-2178 · Cisco · Cisco Evolved Programmable Network Manager+1

Published 2023-04-05 · Updated 2023-04-11 · CVE-2023-20127

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (affected versions not specified) Cisco Evolved Programmable Network Manager (EPNM) (affected versions not specified)

Description The issue is related to the web-based management interface of the affected systems, allowing a remote attacker to obtain privileged information. It also enables cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.

Recommendations For Cisco Prime Infrastructure, update to a version that addresses the issue. For Cisco Evolved Programmable Network Manager (EPNM), update to a version that addresses the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-27

CWE-200

Related Identifiers

BDU:2023-01920

CVE-2023-20127

Affected Products

Cisco Evolved Programmable Network Manager

Cisco Prime Infrastructure

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-20127 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-eRPWAXLe · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-20127 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01920 · Security Note
• https://cybersecurity-help.cz/vdb/SB2023040645 · Note
• https://t.me/cvenotify/48042 · Telegram Post