CVE-2023-20148
Assigner: cisco
Published: 2023-04-05T00:00:00
State: PUBLISHED
title: Cisco Small Business RV016, RV042, RV042G,  RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities
datePublic: 2023-04-05T00:00:00
descriptions: value: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device and then persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco has not released software updates that address these vulnerabilities.
affected: vendor: Cisco
product: Cisco Small Business RV Series Router Firmware 
versions: version: n/a
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-79
cweId: CWE-79
source: advisory: cisco-sa-rv-stored-xss-vqz7gC8W
defect: CSCwe21294
CSCwe75298
CSCwe75302
CSCwe75304
CSCwe75324
CSCwe75338
CSCwe75341
CSCwe75346
CSCwe75348
CSCwe75352
CSCwe75355
CSCwe75367
CSCwe75369
CSCwe75375
CSCwe75377
discovery: INTERNAL
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.