CVE-2023-20188 Cross-site scripting in Cisco Small Business Smart and Managed Switches
Authenticated attackers can inject malicious scripts into the web interface of Cisco Small Business switches, allowing code execution or data theft against other users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-20188?
CVE-2023-20188 is a medium-severity cross-site scripting vulnerability in Cisco Small Business Smart and Managed Switches, published on 28 Jun 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have valid credentials to access the web-based management interface of the affected device. Cisco has not released software updates to address this vulnerability.
Which versions are affected by CVE-2023-20188?
It affects 61 products.
Products include Cisco Sf200-24 Firmware, Cisco Sf200-24fp Firmware, Cisco Sf200-24p Firmware, Cisco Sf200-48 Firmware, Cisco Sf200-48p Firmware, Cisco Sf300-08 Firmware and 55 more.
How do I fix CVE-2023-20188?
No fix has been published for CVE-2023-20188 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-20188 being exploited?
There is no known exploitation of CVE-2023-20188 in the wild and no public exploit code.
Other vulnerabilities in Cisco Small Business Smart and Managed Switches
- CVE-2018-15439 Cisco Small Business Switches Privileged Access Vulnerability
- CVE-2020-3363 Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability
- CVE-2020-3297 Cisco Small Business Smart and Managed Switches Session Management Vulnerability
- CVE-2019-12636 Cisco Small Business Smart and Managed Switches Cross-Site Request Forgery Vulnerability
- CVE-2019-15993 Cisco Small Business Switches Information Disclosure Vulnerability
Sources
Also known as GHSA-hpjg-hqr4-wggc.