CVE-2023-20228

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

• cisco encs 5100 firmware (>= 3.2 < 3.2.15.1) • cisco encs 5400 firmware (>= 3.2 < 3.2.15.1) • cisco ucs c220 m5 rack server firmware (>= 4.2 < 4.3.2.230207) • cisco ucs e160s m3 firmware (< 3.2.15.1) • cisco ucs e180d m3 firmware (< 3.2.15.1) • cisco ucs-e1120d-m3 firmware (< 3.2.15.1)