CVE-2023-20257: XSS
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by submitting malicious input containing script or HTML content within requests that would stored within the application interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks against other users of the affected application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-20257?
The severity of CVE-2023-20257 is rated as medium, indicating a moderate level of risk to affected systems.
How do I fix CVE-2023-20257?
To fix CVE-2023-20257, users should upgrade to the latest patched version of Cisco Prime Infrastructure or Evolved Programmable Network Manager.
What systems are affected by CVE-2023-20257?
CVE-2023-20257 affects Cisco Prime Infrastructure versions up to 3.10.4 and Cisco Evolved Programmable Network Manager versions up to 7.1.1.
Can CVE-2023-20257 be exploited remotely?
Yes, CVE-2023-20257 can be exploited remotely by an authenticated attacker through the web-based management interface.
What type of attack can CVE-2023-20257 enable?
CVE-2023-20257 can enable cross-site scripting attacks due to improper validation of user input.