Cross-Site Scripting Vulnerability in Cisco Prime Infrastructure and Evolved Programmable Network Manager

CVE-2023-20222

Summary

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) allows an unauthenticated, remote attacker to initiate a cross-site scripting (XSS) attack. This type of vulnerability arises from inadequate validation of user-supplied input within the interface. Attackers can exploit this issue by injecting malicious scripts into specific pages of the interface, potentially enabling them to execute arbitrary code in the context of the user's session. As a result, sensitive information stored in the browser may be exposed, creating significant security concerns for users of the affected systems.

References