CVE-2023-20260

CWE-284 — Improper Access ControlCWE-88CWE-80CWE-89 — SQL InjectionCWE-745 documents5 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 94.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cisco Evolved Programmable Network ManagerCisco Prime InfrastructureCisco Cisco Evolved Programmable Network Manager (epnm)+1 more
Timeline
PublishedJan 17

Description

A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underl…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 0.8 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5cisco/cisco_prime_infrastructure143 versions+142

🔴Vulnerability Details

3
GHSA
GHSA-96c9-2v9p-9chw: A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, loca↗2024-01-17
▶
CVEList
CVE-2023-20260: A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, loca↗2024-01-17
▶
GHSA
XWiki Platform vulnerable to code injection from account/view through VFS Tree macro↗2023-04-20
▶

📋Vendor Advisories

1
Cisco
Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Vulnerabilities↗2024-01-10
▶
CVE-2023-20260 (MEDIUM CVSS 6.7) | A vulnerability in the application | cvebase.io