CVE-2023-20188

EUVD-2023-24367 · Published Jun 28, 2023

A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have valid credentials to access the web-based management interface of the affected device. Cisco has not released software updates to address this vulnerability.

Technologies

Cisco Sg300-28Sfp FirmwareCisco Sg500-52P FirmwareCisco Sg500X-48PCisco Sg200-18 FirmwareCisco Sg200-50FpCisco Sf200-48Cisco Sg500-28MppCisco Sf300-48P FirmwareCisco Sf500-48 FirmwareCisco Sf300-24 FirmwareCisco Sf302-08Pp FirmwareCisco Sg500-52PCisco Sf300-48Cisco Sg300-20Cisco Sg300-52P FirmwareCisco Sg200-26PCisco Sg300-52Mp FirmwareCisco Sf500-48Cisco Sg500-28Mpp FirmwareCisco Sf302-08MpCisco Sf200-24Cisco Sg200-26Fp FirmwareCisco Sg300-10Pp FirmwareCisco Sg300-52PCisco Sg300-10MpCisco Sg200-50 FirmwareCisco Sf302-08MppCisco Sg200-26P FirmwareCisco Sg500-28PCisco Sg300-28 FirmwareCisco Sf500-48P FirmwareCisco Sg300-10Cisco Sg300-10PpCisco Sg300-28Cisco Sf500-48Mp FirmwareCisco Sf300-08Cisco Sf500-24MpCisco Sg200-08Cisco Sg300-20 FirmwareCisco Sf200-24PCisco Sf302-08PpCisco Sf300-24PCisco Sf300-48 FirmwareCisco Sg300-10Mpp FirmwareCisco Sf200-24Fp FirmwareCisco Sf302-08Mpp FirmwareCisco Sg200-18Cisco Sg500-52 FirmwareCisco Sg200-08PCisco Sf500-48PCisco Sf302-08 FirmwareCisco Sf200-24 FirmwareCisco Sg300-10P FirmwareCisco Sf302-08P FirmwareCisco Sg500X-48 FirmwareCisco Sf500-48MpCisco Sg300-10MppCisco Sg300-28Pp FirmwareCisco Sg500-52MpCisco Sg300-28MpCisco Sf200-48P FirmwareCisco Sg500X-24Cisco Sg300-10Mp FirmwareCisco Sg200-10FpCisco Sg500-52Mp FirmwareCisco Sg300-28SfpCisco Sg200-50Fp FirmwareCisco Sg300-28P FirmwareCisco Sf302-08Cisco Sf300-24PpCisco Sf500-24P FirmwareCisco Sg500X-24Mpp FirmwareCisco Sg300-10Sfp FirmwareCisco Sg300-52MpCisco Sg500X-24 FirmwareCisco Sf200-24P FirmwareCisco Sf302-08Mp FirmwareCisco Sg200-08P FirmwareCisco Sg300-52 FirmwareCisco Sf300-24MpCisco Sg200-08 FirmwareCisco Sg500X-48Mpp FirmwareCisco Sg300-10SfpCisco Sg500X-48P FirmwareCisco Sg300-28PCisco Sg500X-48Cisco Sg500-28Cisco Sg200-10Fp FirmwareCisco Sf300-24P FirmwareCisco Sg200-26FpCisco Sg300-10 FirmwareCisco Sg500-28 FirmwareCisco Sg500-52Cisco Sf300-48PCisco Sf500-24 FirmwareCisco Sf500-24PCisco Sg200-26 FirmwareCisco Sf500-24Mp FirmwareCisco Sf300-24Cisco Sg500X-24PCisco Sg300-28Mp FirmwareCisco Sg200-26Cisco Sg300-28PpCisco Sg500-28P FirmwareCisco Sg500X-48MppCisco Sg300-52Cisco Sf300-48Pp FirmwareCisco Sf200-24FpCisco Sf300-24Mp FirmwareCisco Sf200-48PCisco Sf300-24Pp FirmwareCisco Sf300-08 FirmwareCisco Sg200-50P FirmwareCisco Sg500X-24MppCisco Sg500X-24P FirmwareCisco Sg200-50PCisco Sg200-50Cisco Sf200-48 FirmwareCisco Sf500-24Cisco Sf302-08PCisco Sf300-48PpCisco Sg300-10P

Weaknesses

CWE-87CWE-79

CVSS scores

v3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-smb-sxss-OPYJZUmE

Potentially impacted assets

See if this affects your attack surface