description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by submitting malicious input containing script or HTML content within requests that would stored within the application interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks against other users of the affected application.
problem types: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
affected:
{
vendor: Cisco
product: Cisco Prime Infrastructure
versions:
version: 2.0.0, status: affected
version: 2.0.10, status: affected
version: 2.0.39, status: affected
version: 2.1.0, status: affected
version: 2.1.1, status: affected
version: 2.1.2, status: affected
version: 2.1.56, status: affected
version: 2.2.0, status: affected
version: 2.2.1, status: affected
version: 2.2.2, status: affected
version: 2.2.3, status: affected
version: 2.2.10, status: affected
version: 2.2.8, status: affected
version: 2.2.4, status: affected
version: 2.2.7, status: affected
version: 2.2.5, status: affected
version: 2.2.9, status: affected
version: 2.2.1 Update 01, status: affected
version: 2.2.2 Update 03, status: affected
version: 2.2.2 Update 04, status: affected
version: 2.2.3 Update 02, status: affected
version: 2.2.3 Update 03, status: affected
version: 2.2.3 Update 04, status: affected
version: 2.2.3 Update 05, status: affected
version: 2.2.3 Update 06, status: affected
version: 3.0.0, status: affected
version: 3.0.1, status: affected
version: 3.0.2, status: affected
version: 3.0.3, status: affected
version: 3.0.4, status: affected
version: 3.0.6, status: affected
version: 3.0.5, status: affected
version: 3.0.7, status: affected
version: 3.1.0, status: affected
version: 3.1.1, status: affected
version: 3.1.7, status: affected
version: 3.1.5, status: affected
version: 3.1.2, status: affected
version: 3.1.3, status: affected
version: 3.1.4, status: affected
version: 3.1.6, status: affected
version: 3.2.2, status: affected
version: 3.2.0-FIPS, status: affected
version: 3.2.1, status: affected
version: 3.3.0, status: affected
version: 3.3.1, status: affected
version: 3.3.0 Update 01, status: affected
version: 3.4.0, status: affected
version: 3.4.1, status: affected
version: 3.4.2, status: affected
version: 3.4.1 Update 01, status: affected
version: 3.4.1 Update 02, status: affected
version: 3.4.2 Update 01, status: affected
version: 3.5.0, status: affected
version: 3.5.1, status: affected
version: 3.5.0 Update 01, status: affected
version: 3.5.0 Update 02, status: affected
version: 3.5.0 Update 03, status: affected
version: 3.5.1 Update 01, status: affected
version: 3.5.1 Update 02, status: affected
version: 3.5.1 Update 03, status: affected
version: 3.6.0, status: affected
version: 3.6.0 Update 01, status: affected
version: 3.6.0 Update 02, status: affected
version: 3.6.0 Update 03, status: affected
version: 3.6.0 Update 04, status: affected
version: 2.1, status: affected
version: 2.2, status: affected
version: 3.2, status: affected
version: 3.4_DP1, status: affected
version: 3.4_DP3, status: affected
version: 3.4_DP2, status: affected
version: 3.5_DP1, status: affected
version: 3.4_DP7, status: affected
version: 3.4_DP10, status: affected
version: 3.4_DP5, status: affected
version: 3.1_DP15, status: affected
version: 3.4_DP11, status: affected
version: 3.4_DP8, status: affected
version: 3.7_DP1, status: affected
version: 3.3_DP4, status: affected
version: 3.10_DP1, status: affected
version: 3.8_DP1, status: affected
version: 3.7_DP2, status: affected
version: 3.6_DP1, status: affected
version: 3.1_DP16, status: affected
version: 3.5_DP4, status: affected
version: 3.3_DP3, status: affected
version: 3.2_DP2, status: affected
version: 3.4_DP4, status: affected
version: 3.1_DP14, status: affected
version: 3.1_DP6, status: affected
version: 3.1_DP9, status: affected
version: 3.4_DP6, status: affected
version: 3.2_DP3, status: affected
version: 3.4_DP9, status: affected
version: 3.3_DP2, status: affected
version: 3.2_DP1, status: affected
version: 3.1_DP10, status: affected
version: 3.9_DP1, status: affected
version: 3.3_DP1, status: affected
version: 3.1_DP13, status: affected
version: 3.5_DP2, status: affected
version: 3.1_DP12, status: affected
version: 3.1_DP4, status: affected
version: 3.5_DP3, status: affected
version: 3.1_DP8, status: affected
version: 3.1_DP7, status: affected
version: 3.2_DP4, status: affected
version: 3.1_DP11, status: affected
version: 3.1_DP5, status: affected
version: 3.7.0, status: affected
version: 3.7.1, status: affected
version: 3.7.1 Update 04, status: affected
version: 3.7.1 Update 06, status: affected
version: 3.7.1 Update 07, status: affected
version: 3.7.1 Update 03, status: affected
version: 3.7.0 Update 03, status: affected
version: 3.7.1 Update 01, status: affected
version: 3.7.1 Update 02, status: affected
version: 3.7.1 Update 05, status: affected
version: 3.8.0, status: affected
version: 3.8.1, status: affected
version: 3.8.1 Update 02, status: affected
version: 3.8.1 Update 04, status: affected
version: 3.8.1 Update 01, status: affected
version: 3.8.1 Update 03, status: affected
version: 3.8.0 Update 01, status: affected
version: 3.8.0 Update 02, status: affected
version: 3.9.0, status: affected
version: 3.9.1, status: affected
version: 3.9.1 Update 02, status: affected
version: 3.9.1 Update 03, status: affected
version: 3.9.1 Update 01, status: affected
version: 3.9.1 Update 04, status: affected
version: 3.9.0 Update 01, status: affected
version: 3.10.0, status: affected
version: 3.10.3, status: affected
version: 3.10.1, status: affected
version: 3.10.2, status: affected
version: 3.10 Update 01, status: affected
version: 3.10.4, status: affected
version: 3.10.4 Update 01, status: affected
}
{
vendor: Cisco
product: Cisco Evolved Programmable Network Manager (EPNM)
versions:
version: 1.2.6, status: affected
version: 1.2.2, status: affected
version: 1.2.3, status: affected
version: 1.2.5, status: affected
version: 1.2.1.2, status: affected
version: 1.2.4, status: affected
version: 1.2.7, status: affected
version: 1.2, status: affected
version: 1.2.2.4, status: affected
version: 1.2.4.2, status: affected
version: 2.0.2, status: affected
version: 2.0.4, status: affected
version: 2.0.3, status: affected
version: 2.0.1, status: affected
version: 2.0, status: affected
version: 2.0.1.1, status: affected
version: 2.0.2.1, status: affected
version: 2.0.4.1, status: affected
version: 2.0.4.2, status: affected
version: 2.1.2, status: affected
version: 2.1.3, status: affected
version: 2.1.1, status: affected
version: 2.1, status: affected
version: 2.1.1.1, status: affected
version: 2.1.1.3, status: affected
version: 2.1.1.4, status: affected
version: 2.1.2.2, status: affected
version: 2.1.2.3, status: affected
version: 2.1.3.2, status: affected
version: 2.1.3.3, status: affected
version: 2.1.3.4, status: affected
version: 2.1.3.5, status: affected
version: 2.1.4, status: affected
version: 2.2.1, status: affected
version: 2.2, status: affected
version: 2.2.1.1, status: affected
version: 2.2.1.2, status: affected
version: 2.2.1.3, status: affected
version: 2.2.1.4, status: affected
version: 2.2.3, status: affected
version: 2.2.4, status: affected
version: 2.2.5, status: affected
version: 3.0.1, status: affected
version: 3.0.2, status: affected
version: 3.0.3, status: affected
version: 3.0, status: affected
version: 3.1.1, status: affected
version: 3.1.2, status: affected
version: 3.1.3, status: affected
version: 3.1, status: affected
version: 4.1.1, status: affected
version: 4.1, status: affected
version: 4.1.1.1, status: affected
version: 4.1.1.2, status: affected
version: 4.0.3, status: affected
version: 4.0.1, status: affected
version: 4.0.2, status: affected
version: 4.0, status: affected
version: 4.0.3.1, status: affected
version: 5.0.1, status: affected
version: 5.0.2, status: affected
version: 5.0.2.5, status: affected
version: 5.0.2.3, status: affected
version: 5.0.2.4, status: affected
version: 5.0.2.1, status: affected
version: 5.0.2.2, status: affected
version: 5.0, status: affected
version: 5.0.2.6, status: affected
version: 5.1.1, status: affected
version: 5.1.2, status: affected
version: 5.1.3, status: affected
version: 5.1.4, status: affected
version: 5.1.4.2, status: affected
version: 5.1.4.1, status: affected
version: 5.1.4.3, status: affected
version: 5.1, status: affected
version: 5.1.3.1, status: affected
version: 5.1.3.2, status: affected
version: 5.1.4.4, status: affected
version: 7.0.0, status: affected
version: 6.0.0, status: affected
version: 6.0.2, status: affected
version: 6.0.1, status: affected
version: 6.0.2.1, status: affected
version: 6.0.1.1, status: affected
version: 6.0.3, status: affected
version: 6.0.3.1, status: affected
version: 6.1.1, status: affected
version: 6.1.1.1, status: affected
version: 6.1, status: affected
version: 6.1.2, status: affected
version: 6.1.1.2.2, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
baseScore: 4.8
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.