CVE-2023-20179 is a medium-severity HTML injection vulnerability affecting the web-based management interface of Cisco Catalyst SD-WAN Manager (formerly vManage). An authenticated, remote attacker could exploit this by injecting malicious HTML content into user-supplied data fields, then persuading another user to view the compromised page. This could lead to modification of the interface and potential browser-based attacks against users. While no active exploitation, public exploit code, or significant community discussion has been observed, the vulnerability has a CVSS score of 5.4 and an EPSS score indicating a low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 20.6.6CPE matchmatch criteria | cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:* | ||
>= 20.7, < 20.10CPE matchmatch criteria | cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.