cisco-sa-sdwan-xss-xXeLFpC3: Cisco SD-WAN vManage Cross-Site Scripting Vulnerability
First published: Wed Oct 07 2020(Updated: )
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-xss-xXeLFpC3
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN vManage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-sdwan-xss-xXeLFpC3?
The severity of cisco-sa-sdwan-xss-xXeLFpC3 is classified as medium due to the potential impact of a cross-site scripting attack.
How do I fix cisco-sa-sdwan-xss-xXeLFpC3?
To fix cisco-sa-sdwan-xss-xXeLFpC3, upgrade the Cisco SD-WAN vManage Software to the latest version provided by Cisco.
Who is affected by cisco-sa-sdwan-xss-xXeLFpC3?
The vulnerability in cisco-sa-sdwan-xss-xXeLFpC3 affects users of the Cisco SD-WAN vManage Software who access the web-based management interface.
What can an attacker do with cisco-sa-sdwan-xss-xXeLFpC3?
An attacker can exploit the vulnerability in cisco-sa-sdwan-xss-xXeLFpC3 to conduct a cross-site scripting (XSS) attack on authenticated users.
Is user authentication required for exploiting cisco-sa-sdwan-xss-xXeLFpC3?
Yes, an attacker must be authenticated to exploit the cisco-sa-sdwan-xss-xXeLFpC3 vulnerability.
- agent/event
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/title
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco sd-wan vmanage