CVE-2023-20257

MEDIUM

4.8

CVSS Score

Published: January 17, 2024 at 04:55 PM UTC

Updated: June 17, 2026 at 05:30 AM UTC

2 products affected across 1 vendorPrime InfrastructureEvolved Programmable Network Manager

Using Cisco Prime Infrastructure by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Prime Infrastructure - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by submitting malicious input containing script or HTML content within requests that would stored within the application interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks against other users of the affected application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Evolved Programmable Network Manager · Cisco

95%

Affected range stops below 7.1.1, so it looks safe — our inference, not a vendor statement

Prime Infrastructure · Cisco

95%

v < 3.10.42.0.0 2.0.10 2.0.39 2.1 2.1.0 2.1.1 2.1.2 2.1.56 2.2 2.2.0 2.2.1 2.2.1 Update 1 2.2.102.2.22.2.2 Update 3 2.2.2 Update 42.2.32.2.3 Update 2 2.2.3 Update 3 2.2.3 Update 4 2.2.3 Update 5 2.2.3 Update 6 2.2.4 2.2.5 2.2.7 2.2.8 2.2.9 3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.0.7 3.1.0 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6 3.1.7 3.10 Update 1 3.10.0 3.10.1 3.10.2 3.10.3 3.10.43.10.4 Update 13.10.4 update_1 3.10_DP1 3.1_DP10 3.1_DP11 3.1_DP12 3.1_DP13 3.1_DP14 3.1_DP15 3.1_DP16 3.1_DP4 3.1_DP5 3.1_DP6 3.1_DP7 3.1_DP8 3.1_DP9 3.2 3.2.0-FIPS 3.2.1 3.2.2 3.2_DP1 3.2_DP2 3.2_DP3 3.2_DP4 3.3.0 3.3.0 Update 1 3.3.1 3.3_DP1 3.3_DP2 3.3_DP3 3.3_DP4 3.4.0 3.4.1 3.4.1 Update 1 3.4.1 Update 2 3.4.2 3.4.2 Update 1 3.4_DP1 3.4_DP10 3.4_DP11 3.4_DP2 3.4_DP3 3.4_DP4 3.4_DP5 3.4_DP6 3.4_DP7 3.4_DP8 3.4_DP9 3.5.0 3.5.0 Update 1 3.5.0 Update 2 3.5.0 Update 3 3.5.1 3.5.1 Update 1 3.5.1 Update 2 3.5.1 Update 3 3.5_DP1 3.5_DP2 3.5_DP3 3.5_DP4 3.6.0 3.6.0 Update 1 3.6.0 Update 2 3.6.0 Update 3 3.6.0 Update 4 3.6_DP1 3.7.0 3.7.0 Update 3 3.7.1 3.7.1 Update 1 3.7.1 Update 2 3.7.1 Update 3 3.7.1 Update 4 3.7.1 Update 5 3.7.1 Update 6 3.7.1 Update 7 3.7_DP1 3.7_DP2 3.8.0 3.8.0 Update 1 3.8.0 Update 2 3.8.1 3.8.1 Update 1 3.8.1 Update 2 3.8.1 Update 3 3.8.1 Update 4 3.8_DP1 3.9.0 3.9.0 Update 1 3.9.1 3.9.1 Update 1 3.9.1 Update 2 3.9.1 Update 3 3.9.1 Update 4 3.9_DP1

Affected range stops below 3.10.4, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.8MEDIUMcisco

Attack Vector: NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-80CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card