Vulnslist

find the latest Cisco vulnerabilities

Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting Vulnerability

cisco-sa-ioxxss-wc6CqUws · Medium · Published · Updated

A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based Local Manager interface of an affected device. The attacker must have valid Local Manager credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based Local Manager interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a system settings tab. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxxss-wc6CqUws

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability.

Customers who do not need to use the Cisco IOx Application Framework can mitigate this vulnerability by disabling IOx on the device by using the no iox configuration command.

CVEsCVE-2020-3233
Cisco Bug IDsCSCvq71085, CSCvr88502, CSCvr88539, CSCvr88504, CSCvr88513
CVSS ScoreBase 6.4
Base 6.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
Product Names From Source
Cisco IOx

CSAF Product Statuses

Product Status Source CVE Rows
Cisco IOx known_affected cisco_csaf CVE-2020-3233 1

Related Products

Product CVE Evidence
Cisco IOx CVE-2020-3233 Cisco OpenVuln