CVE-2023-20131: cisco cisco prime infrastructure Path Traversal: 'dir/../../filename'

Vulnerability summary

CVE-2023-20131 is a medium (CVSS 6.5) Path Traversal: 'dir/../../filename' vulnerability in cisco cisco prime infrastructure. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.2% of scored vulnerabilities.

Timeline

1. 05-04-2023
   PublishedVulnerability first disclosed.
2. 25-10-2024
   Last modifiedVulnerability information updated.

Description

Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory.

• CWE-27Path Traversal: 'dir/../../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.