CVE-2023-20130

CWE-27CWE-352 — Cross-Site Request Forgery (CSRF)CWE-317CWE-804 documents4 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 60.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Evolved Programmable Network ManagerCisco Prime InfrastructureCisco Cisco Prime Infrastructure
Timeline
PublishedApr 5

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDcisco/prime_infrastructure3.10 — 3.10.2+5

🔴Vulnerability Details

2
CVEList
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶
GHSA
GHSA-xc32-hfx9-2wj5: Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) cou↗2023-04-05
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶
CVE-2023-20130 (MEDIUM CVSS 6.5) | Multiple vulnerabilities in the web | cvebase.io