How does CVE-2023-20179 affect Cisco SD-WAN vManage?

CVE-2023-20179 affects Cisco SD-WAN vManage versions up to 20.6.6 and versions between 20.7 and 20.10.

What is the severity of CVE-2023-20179?

The severity of CVE-2023-20179 is medium with a CVSS score of 5.4.

How can an attacker exploit CVE-2023-20179?

An attacker can exploit CVE-2023-20179 by injecting HTML content through improper validation of user-supplied data in element fields.

Is there a fix available for CVE-2023-20179?

Yes, Cisco has released a security advisory and recommended software updates to address CVE-2023-20179. Please refer to the official Cisco Security Advisory for more information.

Vulnerability/
CVE-2023-20179

medium

5.4

CWE

79 80

27/9/2023

23/9/2024

CVE-2023-20179: XSS

Q: What is CVE-2023-20179?

CVE-2023-20179 is a vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, that allows an authenticated, remote attacker to inject HTML content.

First published: Wed Sep 27 2023(Updated: )

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could exploit this vulnerability by submitting malicious content within requests and persuading a user to view a page that contains injected content. A successful exploit could allow the attacker to modify pages within the web-based management interface, possibly leading to further browser-based attacks against users of the application.

Credit: ykramarz@cisco.com ykramarz@cisco.com

Affected Software	Affected Version	How to fix
Cisco SD-WAN vManage	<20.6.6
Cisco SD-WAN vManage	>=20.7<20.10

Never miss a vulnerability like this again

Reference Links

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-html-3ZKh8d6x

Frequently Asked Questions

What is CVE-2023-20179?
CVE-2023-20179 is a vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, that allows an authenticated, remote attacker to inject HTML content.
How does CVE-2023-20179 affect Cisco SD-WAN vManage?
CVE-2023-20179 affects Cisco SD-WAN vManage versions up to 20.6.6 and versions between 20.7 and 20.10.
What is the severity of CVE-2023-20179?
The severity of CVE-2023-20179 is medium with a CVSS score of 5.4.
How can an attacker exploit CVE-2023-20179?
An attacker can exploit CVE-2023-20179 by injecting HTML content through improper validation of user-supplied data in element fields.
Is there a fix available for CVE-2023-20179?
Yes, Cisco has released a security advisory and recommended software updates to address CVE-2023-20179. Please refer to the official Cisco Security Advisory for more information.

collector/nvd-index
agent/author
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/weakness
agent/last-modified-date
agent/references
agent/tags
agent/first-publish-date
agent/event
agent/description
collector/nvd-api
source/NVD
agent/software-canonical-lookup
vendor/cisco
canonical/cisco sd-wan vmanage
version/cisco sd-wan vmanage/20.7

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.