=====================================================================

                                 CERT-Renater

                     Note d'Information No. 2024/VULN025
_____________________________________________________________________

DATE                : 11/01/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Unity Connection,
                       Cisco WAP371 Wireless Access Point,
              Cisco ThousandEyes Enterprise Agent Virtual Appliance
                      Cisco Evolved Programmable Network Manager,
                              Cisco Prime Infrastructure,
                     Cisco BroadWorks Application Delivery Platform, 
                   Cisco BroadWorks Xtended Services Platform,
                             Cisco Identity Services Engine,
                           Cisco TelePresence Management Suite.

=====================================================================
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-unauth-afu-FROYsCsD
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-bHStWgXO
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-6syj82Ju
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-portal-xss-AXNeVg3s
_____________________________________________________________________

Below is the list of Cisco Security Advisories published by Cisco
PSIRT on 2024-January-10.

The following PSIRT security advisories (1 Critical, 6 Medium) were
published at 16:00 UTC today.

Table of Contents:

1) Cisco Unity Connection Unauthenticated Arbitrary File Upload
Vulnerability - SIR: Critical

2) Cisco WAP371 Wireless Access Point Command Injection Vulnerability
- SIR: Medium

3) Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege
Escalation Vulnerability - SIR: Medium

4) Cisco Evolved Programmable Network Manager and Cisco Prime
Infrastructure Vulnerabilities - SIR: Medium

5) Cisco BroadWorks Application Delivery Platform and Xtended Services
Platform Stored Cross-Site Scripting Vulnerability - SIR: Medium

6) Cisco Identity Services Engine Stored Cross-Site Scripting
Vulnerability - SIR: Medium

7) Cisco TelePresence Management Suite Cross-Site Scripting
Vulnerabilities - SIR: Medium

+--------------------------------------------------------------------

1) Cisco Unity Connection Unauthenticated Arbitrary File Upload
Vulnerability

CVE-2024-20272

SIR: Critical

CVSS Score v(3.1): 7.3

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-unauth-afu-FROYsCsD 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuc-unauth-afu-FROYsCsD"]

+--------------------------------------------------------------------

2) Cisco WAP371 Wireless Access Point Command Injection
Vulnerability

CVE-2024-20287

SIR: Medium

CVSS Score v(3.1): 6.5

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-bHStWgXO 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-bHStWgXO"]

+--------------------------------------------------------------------

3) Cisco ThousandEyes Enterprise Agent Virtual Appliance
Privilege Escalation Vulnerability

CVE-2024-20277

SIR: Medium

CVSS Score v(3.1): 6.8

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv"]

+--------------------------------------------------------------------

4) Cisco Evolved Programmable Network Manager and Cisco Prime
Infrastructure Vulnerabilities

CVE-2023-20257, CVE-2023-20258, CVE-2023-20260, CVE-2023-20271

SIR: Medium

CVSS Score v(3.1): 6.5

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq"]

+--------------------------------------------------------------------

5) Cisco BroadWorks Application Delivery Platform and Xtended
Services Platform Stored Cross-Site Scripting Vulnerability

CVE-2024-20270

SIR: Medium

CVSS Score v(3.1): 4.8

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-6syj82Ju 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-6syj82Ju"]

+--------------------------------------------------------------------

6) Cisco Identity Services Engine Stored Cross-Site Scripting
Vulnerability

CVE-2024-20251

SIR: Medium

CVSS Score v(3.1): 4.8

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML"]

+--------------------------------------------------------------------

7) Cisco TelePresence Management Suite Cross-Site Scripting
Vulnerabilities

CVE-2023-20248, CVE-2023-20249

SIR: Medium

CVSS Score v(3.1): 5.4

URL: 
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-portal-xss-AXNeVg3s 
["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-portal-xss-AXNeVg3s"]


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================