CVE-2020-3579 - Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

Back Back to CVE browser

MEDIUM

Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability

Published Nov 6, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.84%

Description

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

Affected products

Vendor Cisco Product Cisco SD-WAN vManage Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco SD-WAN vManage

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24850
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmxss2-NL4KSSVR
vendor-advisoryx_refsource_CISCOPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-24850		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmxss2-NL4KSSVR		vendor-advisoryx_refsource_CISCOPatchVendor Advisory