Cisco Data Center Network Manager Web-based Management Interface cross site scripting

Summaryinfo

A vulnerability was found in Cisco Data Center Network Manager. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Web-based Management Interface. Performing a manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2020-3348. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Cisco Data Center Network Manager (unknown version). This affects an unknown code block of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

The weakness was shared 07/16/2020 as cisco-sa-dncm-xss-AvMyAwd2 as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3348 since 12/12/2019. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading eliminates this vulnerability.

The entry VDB-158710 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Data Center Network Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion