Lucene search

[email protected]CVE-2023-20218

HistoryAug 03, 2023 - 10:15 p.m.

CVE-2023-20218

2023-08-0322:15:11

CWE-80

CWE-79

[email protected]

web.nvd.nist.gov

cisco

spa500 series

analog telephone adapters

ata

web-based management

vulnerability

remote attacker

user input validation

client-side attacks

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

JSON

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user’s browser.

This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks.

Cisco will not release software updates that address this vulnerability.

{{value}} [“%7b%7bvalue%7d%7d”])}]]

Affected configurations

NVD

Node

ciscospa500ds_firmwareMatch-

AND

ciscospa500dsMatch-

Node

ciscospa500s_firmwareMatch-

AND

ciscospa500sMatch-

Node

ciscospa501g_firmwareMatch-

AND

ciscospa501gMatch-

Node

ciscospa502g_firmwareMatch-

AND

ciscospa502gMatch-

Node

ciscospa504g_firmwareMatch-

AND

ciscospa504gMatch-

Node

ciscospa508g_firmwareMatch-

AND

ciscospa508gMatch-

Node

ciscospa509g_firmwareMatch-

AND

ciscospa509gMatch-

Node

ciscospa512g_firmwareMatch-

AND

ciscospa512gMatch-

Node

ciscospa514g_firmwareMatch-

AND

ciscospa514gMatch-

Node

ciscospa525_firmwareMatch-

AND

ciscospa525Match-

Node

ciscospa525g_firmwareMatch-

AND

ciscospa525gMatch-

Node

ciscospa525g2_firmwareMatch-

AND

ciscospa525g2Match-

CPENameOperatorVersion
cisco:spa500ds_firmwarecisco spa500ds firmwareeq-

CPE	Name	Operator	Version
cisco:spa500ds_firmware	cisco spa500ds firmware	eq	-

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Small Business IP Phones",
    "versions": [
      {
        "version": "7.6.0",
        "status": "affected"
      },
      {
        "version": "7.6.2",
        "status": "affected"
      },
      {
        "version": "7.6.2SR3",
        "status": "affected"
      },
      {
        "version": "7.6.2SR6",
        "status": "affected"
      },
      {
        "version": "7.6.2SR2",
        "status": "affected"
      },
      {
        "version": "7.6.2SR4",
        "status": "affected"
      },
      {
        "version": "7.6.2SR1",
        "status": "affected"
      },
      {
        "version": "7.6.2SR5",
        "status": "affected"
      },
      {
        "version": "7.6.2SR7",
        "status": "affected"
      },
      {
        "version": "7.6.1",
        "status": "affected"
      },
      {
        "version": "7.3.7",
        "status": "affected"
      },
      {
        "version": "7.5.5",
        "status": "affected"
      },
      {
        "version": "7.5.6(XU)",
        "status": "affected"
      },
      {
        "version": "7.5.2",
        "status": "affected"
      },
      {
        "version": "7.5.2a",
        "status": "affected"
      },
      {
        "version": "7.5.7",
        "status": "affected"
      },
      {
        "version": "7.5.3",
        "status": "affected"
      },
      {
        "version": "7.5.6",
        "status": "affected"
      },
      {
        "version": "7.5.2b",
        "status": "affected"
      },
      {
        "version": "7.5.6c",
        "status": "affected"
      },
      {
        "version": "7.5.6a",
        "status": "affected"
      },
      {
        "version": "7.5.7s",
        "status": "affected"
      },
      {
        "version": "7.5.1",
        "status": "affected"
      },
      {
        "version": "7.5.5a",
        "status": "affected"
      },
      {
        "version": "7.5.5b",
        "status": "affected"
      },
      {
        "version": "7.5.4",
        "status": "affected"
      },
      {
        "version": "7.4.7",
        "status": "affected"
      },
      {
        "version": "7.4.4",
        "status": "affected"
      },
      {
        "version": "7.4.8",
        "status": "affected"
      },
      {
        "version": "7.4.3",
        "status": "affected"
      },
      {
        "version": "7.4.9",
        "status": "affected"
      },
      {
        "version": "7.4.6",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-spa-web-multi-7kvPmu2F

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

JSON

Related for CVE-2023-20218

cvelist1 nvd1 prion1 cisco1