CVE-2023-20127

CWE-27CWE-317CWE-352 — Cross-Site Request Forgery (CSRF)CWE-806 documents6 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 33.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Prime InfrastructureCisco Cisco Prime Infrastructure
Timeline
PublishedApr 5

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/prime_infrastructure3.10 — 3.10.2+5

🔴Vulnerability Details

2
GHSA
GHSA-jcfr-mrq7-pg9v: Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) cou↗2023-04-05
▶
CVEList
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶

🕵️Threat Intelligence

1
Threat Intel
UAT-8616
▶
CVE-2023-20127 (MEDIUM CVSS 6.5) | Multiple vulnerabilities in the web | cvebase.io