Severity

Medium

Analysis Summary

CVE-2020-3579

The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

Impact

Cross-site scripting

Affected Vendors

Cisco

Affected Products

Cisco SD-WAN vManage Software releases 20.1.12 and earlier and Release 20.3.1

Remediation

Refer to Cisco advisory for the complete list of affected products and their respective patches.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmxss2-NL4KSSVR