CVE-2023-20257: Stored XSS in Cisco Prime Infra
CVE-2023-20257 Published on January 17, 2024

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by submitting malicious input containing script or HTML content within requests that would stored within the application interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks against other users of the affected application.

NVD

Vulnerability Analysis

CVE-2023-20257 can be exploited with network access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a Basic XSS Vulnerability?

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This may allow such characters to be treated as control characters, which are executed client-side in the context of the user's session. Although this can be classified as an injection problem, the more pertinent issue is the improper conversion of such special characters to respective context-appropriate entities before displaying them to the user.

CVE-2023-20257 has been classified to as a Basic XSS vulnerability or weakness.


Products Associated with CVE-2023-20257

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-20257 are published in these products:

Cisco Prime Infrastructure
 
Cisco Evolved Programmable Network Manager
 

Affected Versions

Cisco Prime Infrastructure: Cisco Evolved Programmable Network Manager (EPNM):

Exploit Probability

EPSS
0.06%
Percentile
18.85%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.