CVE-2023-20179 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Cisco Sd-wan Vmanage

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CWE-79 — Cross-site Scripting4 documents4 sources

Severity

5.4MEDIUMNVD

CNA4.3

EPSS

0.1%

top 76.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Sd-wan Vmanage Cisco Sd-wan Vmanage

Timeline

PublishedSep 27

Description

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could exploit this vulnerability by submitting malicious content within requests and persuading a user to view a page that contains injected content. A successful exploit could allow the attacker to modify pag…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDcisco/sd-wan_vmanage20.7 — 20.10+1

▶CVEListV5cisco/cisco_sd-wan_vmanage75 versions+74

🔴Vulnerability Details

CVEList

CVE-2023-20179: A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, r↗2023-09-27

▶

GHSA

GHSA-6g9h-226r-qp89: A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, r↗2023-09-27

▶

📋Vendor Advisories

Cisco

Cisco Catalyst SD-WAN Manager Web UI HTML Injection Vulnerability↗2023-09-27

▶