CVE-2025-20342 A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management…
Description
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid user credentials with privileges that allow for vKVM access on the affected device. Note: The affected vKVM client is also included in Cisco UCS Manager.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Unified Computing System (Managed) | Versions non publiées | |
| Cisco Unified Computing System (Standalone) | Versions non publiées | |
| Cisco Unified Computing System E-Series Software (UCSE) 4.12 | 4.12.1 → 4.12.2 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) | 4.11.1 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) | 4.00 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) 3.2 | 3.2.1 → 3.2.16.1 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) 3.1 | 3.1.0 → 3.1.5 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) 3.0 | 3.0.1 → 3.0.2 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) 2.4 | 2.4.0 → 2.4.2 | Pas de correctif indiqué |
Afficher les 5 autres branches Masquer les 5 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Unified Computing System E-Series Software (UCSE) 2.3 | 2.3.1 → 2.3.5 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) 2.2 | 2.2.1 → 2.2.2 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) | 2.02 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) | 2.1.0 | Pas de correctif indiqué |
| Cisco Unified Computing System E-Series Software (UCSE) | 2.0.0 | Pas de correctif indiqué |
Références
- cisco-sa-ucs-kvmsxss-6h7AnUyk sec.cloudapps.cisco.com
Chronologie
- Publiée
- Dernière modification