CVE-2024-20514

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

5.4MEDIUM

EPSS

0.3%

top 47.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Evolved Programmable Network Manager Cisco Prime Infrastructure Cisco Cisco Evolved Programmable Network Manager (epnm)+1 more

Timeline

PublishedNov 6

Description

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into a specific page o…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5cisco/cisco_evolved_programmable_network_manager_(epnm)104 versions+103

▶NVDcisco/evolved_programmable_network_manager< 8.0.0

▶NVDcisco/prime_infrastructure< 3.10.6

▶CVEListV5cisco/cisco_prime_infrastructure148 versions+147

🔴Vulnerability Details

GHSA

GHSA-cgwv-mmpx-f92h: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow↗2024-11-06

▶

CVEList

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability↗2024-11-06

▶

📋Vendor Advisories

Cisco

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability↗2024-11-06

▶