Sign-up

ID

VAR-202301-0958


CVE

CVE-2023-20037


TITLE

Cisco Industrial Network Director  Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-002207

DESCRIPTION

A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by sending requests containing malicious values to the affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information

Trust: 1.8

sources: NVD: CVE-2023-20037 // JVNDB: JVNDB-2023-002207 // VULHUB: VHN-444815 // VULMON: CVE-2023-20037

AFFECTED PRODUCTS

vendor:ciscomodel:industrial network directorscope:ltversion:1.7.0

Trust: 1.0

vendor:シスコシステムズmodel:cisco industrial network directorscope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco industrial network directorscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-002207 // NVD: CVE-2023-20037

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2023-20037
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2023-20037
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2023-002207
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202301-976
value: MEDIUM

Trust: 0.6

NVD:
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 2.0

OTHER: JVNDB-2023-002207
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-002207 // CNNVD: CNNVD-202301-976 // NVD: CVE-2023-20037 // NVD: CVE-2023-20037

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.1

problemtype:Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-444815 // JVNDB: JVNDB-2023-002207 // NVD: CVE-2023-20037

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-976

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202301-976

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2023-20037

PATCH
title:cisco-sa-ind-fZyVjJtGurl:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ind-fzyvjjtg
Trust: 0.8
title:Cisco Industrial Network Director Fixes for cross-site scripting vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=222292
Trust: 0.6
title:Cisco: Cisco Industrial Network Director Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ind-fzyvjjtg
Trust: 0.1
sources:
            
            
            VULMON: CVE-2023-20037 // 
            
            
            
            JVNDB: JVNDB-2023-002207 // 
            
            
            
            CNNVD: CNNVD-202301-976

EXTERNAL IDS
db:NVDid:CVE-2023-20037
Trust: 3.4
db:JVNDBid:JVNDB-2023-002207
Trust: 0.8
db:AUSCERTid:ESB-2023.0177
Trust: 0.6
db:CNNVDid:CNNVD-202301-976
Trust: 0.6
db:VULHUBid:VHN-444815
Trust: 0.1
db:VULMONid:CVE-2023-20037
Trust: 0.1
sources:
            
            
            VULHUB: VHN-444815 // 
            
            
            
            VULMON: CVE-2023-20037 // 
            
            
            
            JVNDB: JVNDB-2023-002207 // 
            
            
            
            CNNVD: CNNVD-202301-976 // 
            
            
            
            NVD: CVE-2023-20037

REFERENCES
url:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ind-fzyvjjtg
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2023-20037
Trust: 0.8
url:https://cxsecurity.com/cveshow/cve-2023-20037/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2023.0177
Trust: 0.6
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-444815 // 
            
            
            
            VULMON: CVE-2023-20037 // 
            
            
            
            JVNDB: JVNDB-2023-002207 // 
            
            
            
            CNNVD: CNNVD-202301-976 // 
            
            
            
            NVD: CVE-2023-20037

SOURCES
db:VULHUBid:VHN-444815
db:VULMONid:CVE-2023-20037
db:JVNDBid:JVNDB-2023-002207
db:CNNVDid:CNNVD-202301-976
db:NVDid:CVE-2023-20037

LAST UPDATE DATE
2024-01-29T19:19:28.432000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-444815date:2023-01-27T00:00:00
db:VULMONid:CVE-2023-20037date:2023-01-20T00:00:00
db:JVNDBid:JVNDB-2023-002207date:2023-06-23T07:47:00
db:CNNVDid:CNNVD-202301-976date:2023-01-28T00:00:00
db:NVDid:CVE-2023-20037date:2024-01-25T17:15:26.570

SOURCES RELEASE DATE
db:VULHUBid:VHN-444815date:2023-01-20T00:00:00
db:VULMONid:CVE-2023-20037date:2023-01-20T00:00:00
db:JVNDBid:JVNDB-2023-002207date:2023-06-23T00:00:00
db:CNNVDid:CNNVD-202301-976date:2023-01-12T00:00:00
db:NVDid:CVE-2023-20037date:2023-01-20T07:15:15.180