CVE-2023-20131 — Path Traversal: 'dir/../../filename' in Cisco Evolved Programmable Network Manager

CWE-27 — Path Traversal: 'dir/../../filename'CWE-79 — Cross-site ScriptingCWE-317 — Cleartext Storage of Sensitive Information in GUICWE-352 — Cross-Site Request ForgeryCWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)4 documents4 sources
Severity
5.4MEDIUMNVD
CNA6.5
EPSS
0.3%
top 43.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Evolved Programmable Network ManagerCisco Prime InfrastructureCisco Prime Infrastructure
Timeline
PublishedApr 5

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDcisco/prime_infrastructure3.10 — 3.10.2+5

🔴Vulnerability Details

2
CVEList
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶
GHSA
GHSA-7p55-fhcv-9gmg: Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) cou↗2023-04-05
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities↗2023-04-05
▶
CVE-2023-20131 — Path Traversal: 'dir/../../filename' | cvebase