← Back

CVE-2023-20181

nvd nist
Published: Aug 3, 2023Modified: Nov 21, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected (12)

Cisco
12 products
Spa500ds Firmware
Spa500s Firmware
Spa501g Firmware
Spa502g Firmware
Spa504g Firmware
Spa508g Firmware
Spa509g Firmware
Spa512g Firmware
Spa514g Firmware
Spa525 Firmware
Spa525g Firmware
Spa525g2 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa500ds Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa500ds
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa500s Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa500s
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa501g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa501g
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa502g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa502g
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa504g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa504g
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa508g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa508g
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa509g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa509g
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa512g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa512g
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa514g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa514g
All versions
Configuration J
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa525 Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa525
All versions
Configuration K
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa525g Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa525g
All versions
Configuration L
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Spa525g2 Firmware
All versions
Running on/withPlatform Versions
Cisco
Spa525g2
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (2)

Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.