A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-path-trav-zws324yn | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
31 Jul 2025, 15:05
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cisco evolved Programmable Network Manager
Cisco prime Infrastructure Cisco |
|
| CPE | cpe:2.3:a:cisco:prime_infrastructure:3.5.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:2.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.8.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.7.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.3:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.1.5:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:2.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.9.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.4.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.6.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0.3:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:2.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:1.1:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:4.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.1.2:*:*:*:*:*:*:* cpe:2.3:a:cisco:evolved_programmable_network_manager:3.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:prime_infrastructure:3.2.0-fips:*:*:*:*:*:*:* |
|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-path-trav-zws324yn - Vendor Advisory |
15 Nov 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-15 16:15
Updated : 2025-07-31 15:05
NVD link : CVE-2022-20657
Mitre link : CVE-2022-20657
JSON object : View
Products Affected
cisco
- prime_infrastructure
- evolved_programmable_network_manager
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')