Lucene search

[email protected]CVE-2023-20181

HistoryAug 03, 2023 - 10:15 p.m.

CVE-2023-20181

2023-08-0322:15:10

CWE-79

CWE-80

[email protected]

web.nvd.nist.gov

cisco

small business

spa500

ip phones

xss

vulnerability

web-based

management interface

cve-2023-20181

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected configurations

NVD

Node

ciscospa500ds_firmwareMatch-

AND

ciscospa500dsMatch-

Node

ciscospa500s_firmwareMatch-

AND

ciscospa500sMatch-

Node

ciscospa501g_firmwareMatch-

AND

ciscospa501gMatch-

Node

ciscospa502g_firmwareMatch-

AND

ciscospa502gMatch-

Node

ciscospa504g_firmwareMatch-

AND

ciscospa504gMatch-

Node

ciscospa508g_firmwareMatch-

AND

ciscospa508gMatch-

Node

ciscospa509g_firmwareMatch-

AND

ciscospa509gMatch-

Node

ciscospa512g_firmwareMatch-

AND

ciscospa512gMatch-

Node

ciscospa514g_firmwareMatch-

AND

ciscospa514gMatch-

Node

ciscospa525_firmwareMatch-

AND

ciscospa525Match-

Node

ciscospa525g_firmwareMatch-

AND

ciscospa525gMatch-

Node

ciscospa525g2_firmwareMatch-

AND

ciscospa525g2Match-

CPENameOperatorVersion
cisco:spa500ds_firmwarecisco spa500ds firmwareeq-

CPE	Name	Operator	Version
cisco:spa500ds_firmware	cisco spa500ds firmware	eq	-

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Small Business IP Phones",
    "versions": [
      {
        "version": "7.6.0",
        "status": "affected"
      },
      {
        "version": "7.6.2",
        "status": "affected"
      },
      {
        "version": "7.6.2SR3",
        "status": "affected"
      },
      {
        "version": "7.6.2SR6",
        "status": "affected"
      },
      {
        "version": "7.6.2SR2",
        "status": "affected"
      },
      {
        "version": "7.6.2SR4",
        "status": "affected"
      },
      {
        "version": "7.6.2SR1",
        "status": "affected"
      },
      {
        "version": "7.6.2SR5",
        "status": "affected"
      },
      {
        "version": "7.6.2SR7",
        "status": "affected"
      },
      {
        "version": "7.6.1",
        "status": "affected"
      },
      {
        "version": "7.3.7",
        "status": "affected"
      },
      {
        "version": "7.5.5",
        "status": "affected"
      },
      {
        "version": "7.5.6(XU)",
        "status": "affected"
      },
      {
        "version": "7.5.2",
        "status": "affected"
      },
      {
        "version": "7.5.2a",
        "status": "affected"
      },
      {
        "version": "7.5.7",
        "status": "affected"
      },
      {
        "version": "7.5.3",
        "status": "affected"
      },
      {
        "version": "7.5.6",
        "status": "affected"
      },
      {
        "version": "7.5.2b",
        "status": "affected"
      },
      {
        "version": "7.5.6c",
        "status": "affected"
      },
      {
        "version": "7.5.6a",
        "status": "affected"
      },
      {
        "version": "7.5.7s",
        "status": "affected"
      },
      {
        "version": "7.5.1",
        "status": "affected"
      },
      {
        "version": "7.5.5a",
        "status": "affected"
      },
      {
        "version": "7.5.5b",
        "status": "affected"
      },
      {
        "version": "7.5.4",
        "status": "affected"
      },
      {
        "version": "7.4.7",
        "status": "affected"
      },
      {
        "version": "7.4.4",
        "status": "affected"
      },
      {
        "version": "7.4.8",
        "status": "affected"
      },
      {
        "version": "7.4.3",
        "status": "affected"
      },
      {
        "version": "7.4.9",
        "status": "affected"
      },
      {
        "version": "7.4.6",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

Related for CVE-2023-20181

prion1 cvelist1 nvd1 cisco1