CVE-2023-20263

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
CiscoCisco HyperFlex HX Data Platform4.0(1a); 4.0(1b); 4.0(2a); 4.0(2b); 4.0(2c); 4.0(2d); 4.0(2e); 4.0(2f); 4.5(1a); 4.5(2a); 4.5(2b); 4.5(2c); 4.5(2d); 4.5(2e); 5.0(1a); 5.0(1b); 5.0(1c); 5.0(2a); 5.0(2b)

References

Timeline

Published
Sep 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-202646.1A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco ACVE-2023-202655.4A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to CVE-2023-202667.2A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager SessioCVE-2023-202675.3A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restCVE-2023-202684.7A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attackerCVE-2023-202699.1A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDCVE-2023-20279.8The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is duCVE-2023-202705.8A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco FCVE-2023-202716.5A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coCVE-2023-202728.8A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplCVE-2023-202737.2A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the priCVE-2023-202747.8A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on
CVE-2023-20263: Medium severity, CVSS 6.1 | Vulnix