Cross-site scripting in Cisco Systems, Inc products - CVE-2023-20204
Published: August 3, 2023
Vulnerability identifier: #VU78886
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2023-20204
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management interface. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
BroadWorks Application Server
BroadWorks Xtended Services Platform
BroadWorks CommPilot Application Software
BroadWorks Application Delivery Platform
BroadWorks Xtended Services Platform
BroadWorks CommPilot Application Software
BroadWorks Application Delivery Platform
How to mitigate CVE-2023-20204
Install updates from vendor's website.
BroadWorks Application Server - addressed in versions AP.as.23.0.1075.ap385295, AP.as.24.0.944.ap385295, 2023.06
BroadWorks Xtended Services Platform - update to AP.xsp.23.0.1075.ap385295
BroadWorks Application Delivery Platform - update to 2023.06
BroadWorks Xtended Services Platform - update to AP.xsp.23.0.1075.ap385295
BroadWorks Application Delivery Platform - update to 2023.06