2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2023-20148" ,
"sourceIdentifier" : "ykramarz@cisco.com" ,
"published" : "2023-04-05T19:15:09.220" ,
2023-11-07 21:03:21 +00:00
"lastModified" : "2023-11-07T04:06:14.363" ,
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device and then persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco has not released software updates that address these vulnerabilities."
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.1 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.7
2023-11-07 21:03:21 +00:00
} ,
2023-04-24 12:24:31 +02:00
{
2024-04-04 08:46:00 +00:00
"source" : "ykramarz@cisco.com" ,
2023-04-24 12:24:31 +02:00
"type" : "Secondary" ,
"cvssData" : {
2023-11-07 21:03:21 +00:00
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.1 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.7
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
} ,
{
2024-04-04 08:46:00 +00:00
"source" : "ykramarz@cisco.com" ,
2023-04-24 12:24:31 +02:00
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv016_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CCC05438-3064-4FB6-9177-9EA60C8E250C"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv016:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "701E3CF5-15C0-419A-97A8-9BD2C55D74AB"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv042_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F5A39236-B032-46BB-94D0-3E0E3E557BC0"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv042:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "2DCBB2D8-AACF-45EA-B9D4-DAECC7C792D1"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv042g_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "E699C11F-3C7C-420D-9243-5CD2A6B98EF2"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv042g:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F1CD7D9C-DDEF-4DF0-BCFB-A45301AE2C10"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv082_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "9EF65E38-D812-4F6E-903C-05E203F3E9F6"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv082:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "24FC4446-22C0-4EC9-84B4-A76412680105"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv320_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "C0C17C5F-4EB7-4859-8127-AE027A72CB2C"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv320:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7596F6D4-10DA-4F29-95AD-75B60F4670D6"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:cisco:rv325_firmware:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "69F1C458-0EF3-4AD6-9055-355711F3751E"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:h:cisco:rv325:-:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "3435D601-EDA8-49FF-8841-EA6DF1518C75"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-stored-xss-vqz7gC8W" ,
"source" : "ykramarz@cisco.com" ,
"tags" : [
"Vendor Advisory"
]
}
]
}
