Details of VAR-202301-0958

ID

VAR-202301-0958

CVE

CVE-2023-20037

TITLE

Cisco Industrial Network Director Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-002207

DESCRIPTION

A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by sending requests containing malicious values to the affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information

Trust: 1.8

sources: NVD: CVE-2023-20037 // JVNDB: JVNDB-2023-002207 // VULHUB: VHN-444815 // VULMON: CVE-2023-20037

AFFECTED PRODUCTS

vendor:	cisco	model:	industrial network director	scope:	lt	version:	1.7.0	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco industrial network director	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco industrial network director	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-002207 // NVD: CVE-2023-20037

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-20037
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2023-20037
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2023-002207
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202301-976
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2023-20037
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2023-002207
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-002207 // CNNVD: CNNVD-202301-976 // NVD: CVE-2023-20037 // NVD: CVE-2023-20037

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.1
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-444815 // JVNDB: JVNDB-2023-002207 // NVD: CVE-2023-20037

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-976

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202301-976

PATCH

title:	cisco-sa-ind-fZyVjJtG	url:	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG	Trust: 0.8
title:	Cisco Industrial Network Director Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=222292	Trust: 0.6
title:	Cisco: Cisco Industrial Network Director Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ind-fZyVjJtG	Trust: 0.1

sources: VULMON: CVE-2023-20037 // JVNDB: JVNDB-2023-002207 // CNNVD: CNNVD-202301-976

EXTERNAL IDS

db:	NVD	id:	CVE-2023-20037	Trust: 3.4
db:	JVNDB	id:	JVNDB-2023-002207	Trust: 0.8
db:	AUSCERT	id:	ESB-2023.0177	Trust: 0.6
db:	CNNVD	id:	CNNVD-202301-976	Trust: 0.6
db:	VULHUB	id:	VHN-444815	Trust: 0.1
db:	VULMON	id:	CVE-2023-20037	Trust: 0.1

sources: VULHUB: VHN-444815 // VULMON: CVE-2023-20037 // JVNDB: JVNDB-2023-002207 // CNNVD: CNNVD-202301-976 // NVD: CVE-2023-20037

REFERENCES

url:	https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ind-fzyvjjtg	Trust: 1.9
url:	https://nvd.nist.gov/vuln/detail/cve-2023-20037	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-20037/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2023.0177	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-444815 // VULMON: CVE-2023-20037 // JVNDB: JVNDB-2023-002207 // CNNVD: CNNVD-202301-976 // NVD: CVE-2023-20037

SOURCES

db:	VULHUB	id:	VHN-444815
db:	VULMON	id:	CVE-2023-20037
db:	JVNDB	id:	JVNDB-2023-002207
db:	CNNVD	id:	CNNVD-202301-976
db:	NVD	id:	CVE-2023-20037

LAST UPDATE DATE

2024-08-14T15:26:54.600000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-444815	date:	2023-01-27T00:00:00
db:	VULMON	id:	CVE-2023-20037	date:	2023-01-20T00:00:00
db:	JVNDB	id:	JVNDB-2023-002207	date:	2023-06-23T07:47:00
db:	CNNVD	id:	CNNVD-202301-976	date:	2023-01-28T00:00:00
db:	NVD	id:	CVE-2023-20037	date:	2024-01-25T17:15:26.570

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-444815	date:	2023-01-20T00:00:00
db:	VULMON	id:	CVE-2023-20037	date:	2023-01-20T00:00:00
db:	JVNDB	id:	JVNDB-2023-002207	date:	2023-06-23T00:00:00
db:	CNNVD	id:	CNNVD-202301-976	date:	2023-01-12T00:00:00
db:	NVD	id:	CVE-2023-20037	date:	2023-01-20T07:15:15.180