CVE-2023-20131
05.04.2023, 18:15
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.
| Vendor | Product | Version |
|---|---|---|
| cisco | prime_infrastructure | 𝑥 ≤ 3.7 |
| cisco | prime_infrastructure | 3.10 ≤ 𝑥 < 3.10.2 |
| cisco | prime_infrastructure | 3.8 |
| cisco | prime_infrastructure | 3.8.1 |
| cisco | prime_infrastructure | 3.9 |
| cisco | prime_infrastructure | 3.9.1 |
| cisco | evolved_programmable_network_manager | 𝑥 < 5.0.2.5 |
| cisco | evolved_programmable_network_manager | 5.1 ≤ 𝑥 < 5.1.4.2 |
| cisco | evolved_programmable_network_manager | 6.0 ≤ 𝑥 < 6.0.2.1 |
| cisco | evolved_programmable_network_manager | 6.1 ≤ 𝑥 < 6.1.1.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-27 - Path Traversal: 'dir/../../filename'The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.