Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure. It occurs because the interface does not properly validate user-supplied input, allowing an authenticated remote attacker with valid administrative credentials to insert malicious code into specific data fields. This malicious code can then execute arbitrary scripts in the context of the affected interface or access sensitive browser-based information.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary script code within the management interface, potentially leading to unauthorized actions or access to sensitive information available in the browser context. Since the attacker needs valid administrative credentials, the impact is limited to users with such access, but it could still compromise the integrity and confidentiality of the management system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that only trusted administrators have access to the web-based management interface, as exploitation requires valid administrative credentials. Additionally, monitor and restrict input fields in the interface to prevent insertion of malicious scripts. Applying any available patches or updates from Cisco for EPNM and Prime Infrastructure is recommended once released.

Useful 0 Not Useful 0