Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cross-Site Scripting Vulnerability (Cisco Cisco Evolved Programmable Network Manager (EPNM))
En bref
- Source
- NVD
- EPSS
- EPSS 0.54 % · centile 45 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Analyzed
Description
A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | cisco |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · psirt@cisco.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2022-25907
- GCVE · GCVE-0-2022-20657
Configurations affectées (CPE NVD)
cpe:2.3:a:cisco:prime_infrastructure:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.0.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.1.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.1.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.2.0-fips:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.3.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.4.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.5.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.6.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.7.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.8.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:prime_infrastructure:3.9.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1.2:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Cisco · Cisco Evolved Programmable Network Manager (EPNM) | affected 3.0.1 ; affected 3.1.2 ; affected 1.2 ; affected 3.1.1 ; affected 3.1.3 ; affected 3.1 |
| Cisco · Cisco Prime Infrastructure | affected 3.0.0 ; affected 3.1.0 ; affected 3.1.5 ; affected 2.1 ; affected 2.0.0 ; affected 3.6.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |