CVE-2022-20639: Cisco Security Manager Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-20639?
CVE-2022-20639 is rated as high severity due to the potential for unauthenticated remote attackers to exploit the vulnerability.
How do I fix CVE-2022-20639?
To fix CVE-2022-20639, update Cisco Security Manager to the latest version that addresses the cross-site scripting vulnerabilities.
What type of attacks can be performed due to CVE-2022-20639?
CVE-2022-20639 allows attackers to conduct cross-site scripting attacks against users of the web-based management interface.
Which versions of Cisco Security Manager are affected by CVE-2022-20639?
CVE-2022-20639 affects all versions of Cisco Security Manager prior to version 4.24.
Is user authentication required to exploit CVE-2022-20639?
No, CVE-2022-20639 can be exploited by unauthenticated remote attackers.