Cisco SD-WAN Manager XSS via improper input validation
CVE-2023-20179 Published on September 27, 2023

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could exploit this vulnerability by submitting malicious content within requests and persuading a user to view a page that contains injected content. A successful exploit could allow the attacker to modify pages within the web-based management interface, possibly leading to further browser-based attacks against users of the application.

NVD

Vulnerability Analysis

CVE-2023-20179 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a Basic XSS Vulnerability?

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This may allow such characters to be treated as control characters, which are executed client-side in the context of the user's session. Although this can be classified as an injection problem, the more pertinent issue is the improper conversion of such special characters to respective context-appropriate entities before displaying them to the user.

CVE-2023-20179 has been classified to as a Basic XSS vulnerability or weakness.


Products Associated with CVE-2023-20179

stack.watch emails you whenever new vulnerabilities are published in Cisco Sd Wan Vmanage or Cisco Catalyst Sd Wan Manager. Just hit a watch button to start following.

Cisco Sd Wan Vmanage
 
Cisco Catalyst Sd Wan Manager
 

Affected Versions

Cisco SD-WAN vManage:

Exploit Probability

EPSS
0.08%
Percentile
23.77%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.