Arthur Donkers

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (affected versions not specified) **Description** A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This issue exists due to the interface not properly validating user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information. **Recommendations** For Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider restricting access to the web-based management interface until a patch is applied. Avoid using the interface with untrusted input until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Cisco Prime Infrastructure versions (affected versions not specified) Cisco Evolved Programmable Network Manager versions (affected versions not specified) **Description** The issue is related to insufficient input validation of the HTTPS URL by the web-based management interface, allowing an authenticated, remote attacker to conduct a path traversal attack. This could enable the attacker to write arbitrary files to the host system. The attacker must have valid credentials on the system to exploit this vulnerability. **Recommendations** For Cisco Prime Infrastructure, update to a version that includes the software updates released by Cisco to address this issue. For Cisco Evolved Programmable Network Manager, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.