Description
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Metrics
CVSS 3.1 6.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Identity Services Engine Software | N/A |
| Cisco | Cisco Unified Computing System (Standalone) | 3.1(1d); 3.1(2b); 3.1(2c); 3.1(2d); 3.1(2e); 3.1(2g); 3.1(2i); 3.1(3a); 3.1(3b); 3.1(3c); 3.1(3d); 3.1(3g); 3.1(3h); 3.1(3i); 3.1(3j); 3.1(3k); 4.0(1.240); 4.0(1a); 4.0(1b); 4.0(1c) |
| Cisco | Cisco Unified Computing System E-Series Software (UCSE) | 2.1.0; 2.4.0; 2.4.1; 2.4.2; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.6; 3.2.7; 3.2.10; 3.2.11.1; 3.2.8; 3.2.11.3; 3.2.11.5; 3.2.12.2; 3.2.13.6; 3.2.14; 3.1.1; 3.1.2 |
References
Timeline
- Published
- Aug 16, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified