PT-2023-4585 · Cisco · Cisco Evolved Programmable Network Manager+1
Published
2023-08-16
·
Updated
2024-01-25
·
CVE-2023-20203
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Prime Infrastructure (affected versions not specified)
Cisco Evolved Programmable Network Manager (EPNM) (affected versions not specified)
Description
The issue is related to insufficient validation of user-supplied input in the web-based management interface, which could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. An attacker could exploit this by persuading a user to view a page containing malicious HTML or script content, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.
Recommendations
For Cisco Prime Infrastructure, restrict access to the web-based management interface until a fix is available.
For Cisco Evolved Programmable Network Manager (EPNM), consider disabling the interface or limiting user access to prevent exploitation.
As a temporary workaround, avoid using the web-based management interface for sensitive operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Evolved Programmable Network Manager
Cisco Prime Infrastructure