Stored XSS Vulnerability in Cisco Prime Infrastructure and EPNM Management Interfaces

CVE-2023-20203

Summary

Multiple vulnerabilities exist in the web-based management interfaces of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager, allowing authenticated remote attackers to execute stored cross-site scripting (XSS) attacks. These vulnerabilities arise from inadequate validation of user-supplied input, enabling attackers to craft pages with malicious HTML or script content. To exploit these vulnerabilities, an attacker must have valid authentication credentials, persuading users to access the altered pages. This exploit could lead to the execution of arbitrary script code in the affected interface's context, potentially exposing sensitive browser information.

References