4.3
Medium
CVE-2023-20179 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage,…
Description
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to inject HTML content. This vulnerability is due to improper validation of user-supplied data in element fields. An attacker could exploit this vulnerability by submitting malicious content within requests and persuading a user to view a page that contains injected content. A successful exploit could allow the attacker to modify pages within the web-based management interface, possibly leading to further browser-based attacks against users of the application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco SD-WAN vManage 20.11 | 20.11.1 → 20.11.1.2 | No fix stated |
| Cisco SD-WAN vManage 20.10 | 20.10.1 → 20.10.1.2 | No fix stated |
| Cisco SD-WAN vManage 20.9 | 20.9.1 → 20.9.4 | No fix stated |
| Cisco SD-WAN vManage | 20.8.1 | No fix stated |
| Cisco SD-WAN vManage 20.7 | 20.7.1 → 20.7.2 | No fix stated |
| Cisco SD-WAN vManage 20.6 | 20.6.1 → 20.6.5.5 | No fix stated |
| Cisco SD-WAN vManage 20.5 | 20.5.1 → 20.5.1.2 | No fix stated |
| Cisco SD-WAN vManage 20.4 | 20.4.1 → 20.4.2.3 | No fix stated |
| Cisco SD-WAN vManage 20.3 | 20.3.1 → 20.3.7.2 | No fix stated |
References
- cisco-sa-vmanage-html-3ZKh8d6x sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco SD-WAN vManage
The 61 CVEs of Cisco SD-WAN vManage →
CVE-2023-20261
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve…
6.5
Medium
CVE-2023-20252
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could…
9.8
Critical
CVE-2023-20262
A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to…
5.3
Medium
CVE-2023-20034
Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated,…
7.5
High