CVEvulnerability

CVE-2023-20130

6.5 MEDIUM Published 2023-04-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-27, CWE-352

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

Affected configurations

• cisco prime infrastructure (<= 3.7) • cisco prime infrastructure (>= 3.10 < 3.10.2) • cisco prime infrastructure 3.8 • cisco prime infrastructure 3.8.1 • cisco prime infrastructure 3.9 • cisco prime infrastructure 3.9.1 • cisco evolved programmable network manager (< 5.0.2.5) • cisco evolved programmable network manager (>= 5.1 < 5.1.4.2) • cisco evolved programmable network manager (>= 6.0 < 6.0.2.1) • cisco evolved programmable network manager (>= 6.1 < 6.1.1.1)

Related

Weakness · CWE (2)

  • CWE-27 Path Traversal: 'dir/../../filename' weakness
  • CWE-352 Cross-Site Request Forgery weakness

References