Cisco Data Center Network Manager Web-based Management Interface HTTP Header cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in Cisco Data Center Network Manager. The impacted element is an unknown function of the component Web-based Management Interface. Executing a manipulation as part of HTTP Header can lead to cross site scripting. This vulnerability is tracked as CVE-2020-3460. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Cisco Data Center Network Manager (the affected version unknown) and classified as problematic. This vulnerability affects an unknown part of the component Web-based Management Interface. The manipulation as part of a HTTP Header leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by intercepting a request from a user and injecting malicious data into an HTTP header. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

The weakness was disclosed 07/31/2020 as cisco-sa-dcnm-xss-3jkDLsLV as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2020-3460 since 12/12/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading eliminates this vulnerability.

The entries VDB-159234, VDB-159233, VDB-159231 and VDB-159230 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Data Center Network Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion