Cisco AppDynamics up to 23.7.1 Web-based Management Interface cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Cisco AppDynamics. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2024-20346. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco AppDynamics. It has been declared as problematic. This vulnerability affects an unknown code block of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

The weakness was shared 03/06/2024 as cisco-sa-appd-xss-3JwqSMNT. The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2024-20346 since 11/08/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Cisco

Name

• AppDynamics

Version

• 21.2.0
• 21.2.1
• 21.2.2
• 21.2.3
• 21.2.6
• 21.2.7
• 21.2.8
• 21.4.0
• 21.4.2
• 21.4.3
• 21.4.4
• 21.4.5
• 21.4.6
• 21.4.7
• 21.4.8
• 21.4.9
• 21.4.10
• 21.4.11
• 21.5.0
• 21.6.0
• 21.7.0
• 21.11.0
• 21.12.0
• 21.12.1
• 21.12.2
• 22.1.0
• 22.1.1
• 22.3.0
• 22.8.0
• 22.10.0
• 22.11.0
• 22.12.0
• 22.12.1
• 23.2.0
• 23.4.0
• 23.7.0
• 23.7.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion