© 2026 vulntracker.io

CVE-2023-20222

MEDIUM

6.1

CVSS Score

Published: August 16, 2023 at 09:39 PM UTC

Updated: June 17, 2026 at 05:29 AM UTC

2 products affected across 1 vendorPrime InfrastructureEvolved Programmable Network Manager

Using Cisco Prime Infrastructure by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Prime Infrastructure - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.5%

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Evolved Programmable Network Manager · Cisco

95%

v ≤ 7.0

Prime Infrastructure · Cisco

95%

v ≤ 3.102.0.0 2.0.10 2.0.39 2.1 2.1.0 2.1.1 2.1.2 2.1.56 2.2 2.2.0 2.2.1 2.2.1 Update 1 2.2.102.2.22.2.2 Update 3 2.2.2 Update 42.2.32.2.3 Update 2 2.2.3 Update 3 2.2.3 Update 4 2.2.3 Update 5 2.2.3 Update 6 2.2.4 2.2.5 2.2.7 2.2.8 2.2.9 3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.1.0 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6 3.1.7 3.10.0 3.10.1 3.10.2 3.10.3 3.10.4 3.10_DP1 3.1_DP10 3.1_DP11 3.1_DP12 3.1_DP13 3.1_DP14 3.1_DP15 3.1_DP16 3.1_DP4 3.1_DP5 3.1_DP6 3.1_DP7 3.1_DP8 3.1_DP9 3.2 3.2.0-FIPS 3.2.1 3.2.2 3.2_DP1 3.2_DP2 3.2_DP3 3.2_DP4 3.3.0 3.3.0 Update 1 3.3.1 3.3_DP1 3.3_DP2 3.3_DP3 3.3_DP4 3.4.0 3.4.1 3.4.1 Update 1 3.4.1 Update 2 3.4.2 3.4.2 Update 1 3.4_DP1 3.4_DP10 3.4_DP11 3.4_DP2 3.4_DP3 3.4_DP4 3.4_DP5 3.4_DP6 3.4_DP7 3.4_DP8 3.4_DP9 3.5.0 3.5.0 Update 1 3.5.0 Update 2 3.5.0 Update 3 3.5.1 3.5.1 Update 1 3.5.1 Update 2 3.5.1 Update 3 3.5_DP1 3.5_DP2 3.5_DP3 3.5_DP4 3.6.0 3.6.0 Update 1 3.6.0 Update 2 3.6.0 Update 3 3.6.0 Update 4 3.6_DP1 3.7.0 3.7.0 Update 3 3.7.1 3.7.1 Update 1 3.7.1 Update 2 3.7.1 Update 3 3.7.1 Update 4 3.7.1 Update 5 3.7.1 Update 6 3.7.1 Update 7 3.7_DP1 3.7_DP2 3.8.0 3.8.0 Update 1 3.8.0 Update 2 3.8.1 3.8.1 Update 1 3.8.1 Update 2 3.8.1 Update 3 3.8.1 Update 4 3.8_DP1 3.9.0 3.9.0 Update 1 3.9.1 3.9.1 Update 1 3.9.1 Update 2 3.9.1 Update 3 3.9.1 Update 4 3.9_DP1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-storedxss-tTjO62r

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-storedxss-tTjO62r

CVSS

6.1MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-80CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card