CVE-2020-3356: Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by interacting with the interface in a way that injects malicious content in a log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3356?
CVE-2020-3356 is a vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
How does CVE-2020-3356 affect Cisco Data Center Network Manager?
CVE-2020-3356 affects Cisco Data Center Network Manager versions up to and including 11.3(1).
What is the severity of CVE-2020-3356?
The severity of CVE-2020-3356 is medium, with a CVSS score of 6.1.
What is cross-site scripting (XSS) attack?
Cross-site scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into trusted websites viewed by other users.
How can I fix CVE-2020-3356 in Cisco Data Center Network Manager?
To fix CVE-2020-3356 in Cisco Data Center Network Manager, apply the necessary security patches or updates provided by Cisco.