CVE-2022-20726
Assigner: cisco
Published: 2022-04-13T00:00:00
State: PUBLISHED
affected: product: Cisco IOS 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2022-04-13T00:00:00
descriptions: value: Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-22
description: CWE-22
type: CWE
source: advisory: cisco-sa-iox-yuXQ6hFj
defect: CSCvx27640
CSCvy16608
CSCvy30903
CSCvy30957
CSCvy35913
CSCvy35914
CSCvy86583
CSCvy86598
CSCvy86602
CSCvy86603
CSCvy86604
CSCvy86608
discovery: INTERNAL
title: Cisco IOx Application Hosting Environment Vulnerabilities