CVE-2023-20218— Cisco Small Business SPA500 Series IP Phones 跨站脚本漏洞

N/A

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)

Cisco Small Business SPA500 Series IP Phones 跨站脚本漏洞

Cisco Small Business SPA500 Series IP Phones是美国思科（Cisco）公司的一款SPA500系列IP电话。 Cisco Small Business SPA500 Series IP Phones 存在跨站脚本漏洞，该漏洞源于 Web 的管理界面中存在多个漏洞，可能允许未经身份验证的远程攻击者进行 HTML 注入攻击。

N/A

N/A