CVE-2023-20204: XSS
First published: Thu Aug 03 2023(Updated: )
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco BroadWorks Application Delivery Platform | <ri.2023.06 | |
| Cisco BroadWorks Application Server | <23.0.2023.08 | |
| Cisco BroadWorks Application Server | <2023.06 | |
| Cisco BroadWorks Application Server | >=24.0<24.0.2023.08 | |
| Cisco BroadWorks Xtended Services Platform | <23.0.2023.08 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20204.
What is the severity of CVE-2023-20204?
The severity of CVE-2023-20204 is medium with a CVSS score of 5.4.
How does the vulnerability affect Cisco BroadWorks CommPilot Application Software?
The vulnerability allows an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
Which software versions are affected by CVE-2023-20204?
Cisco BroadWorks Application Delivery Platform up to exclusive version ri.2023.06, Cisco Broadworks Application Server up to exclusive version 23.0.2023.08, Cisco Broadworks Application Server up to exclusive version 2023.06, Cisco Broadworks Application Server between inclusive exclusive version 24.0 (exclusive) and 24.0.2023.08 (inclusive), and Cisco BroadWorks Xtended Services Platform up to exclusive version 23.0.2023.08.
How can the vulnerability be fixed?
A software update is available to address this vulnerability. Users should update to the patched versions provided by Cisco to protect against the exploit.
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco broadworks application delivery platform
- canonical/cisco broadworks application server
- version/cisco broadworks application server/24.0
- canonical/cisco broadworks xtended services platform