CVE-2023-20257

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-17 · updated 2026-06-17
Weakness: CWE-80

Description

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by submitting malicious input containing script or HTML content within requests that would stored within the application interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks against other users of the affected application.

Affected products

Cisco Evolved Programmable Network Manager (EPNM): before 7.1.1 — fixed in 7.1.1
Cisco Prime Infrastructure: before 3.10.4; 3.10.4, 3.10.4-update_1 — fixed in 3.10.4

How to fix

Upgrade to a fixed version: Cisco Evolved Programmable Network Manager (EPNM) 7.1.1; Cisco Prime Infrastructure 3.10.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-20257 or the next vulnerability affects your stack