CVE-2020-3579: Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-3579.
What is the severity of CVE-2020-3579?
The severity of CVE-2020-3579 is medium with a CVSS score of 6.1.
What is the affected software for CVE-2020-3579?
The affected software for CVE-2020-3579 includes Cisco Catalyst SD-WAN Manager version 20.3.1 and Cisco SD-WAN vManage up to and including version 20.1.12.
What is the vulnerability description of CVE-2020-3579?
CVE-2020-3579 is a vulnerability in the web-based management interface of Cisco SD-WAN vManage Software that allows an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
How can I fix CVE-2020-3579?
To fix CVE-2020-3579, it is recommended to upgrade to a fixed version of Cisco Catalyst SD-WAN Manager or Cisco SD-WAN vManage.