cve-2023-20254
Vulnerability from cvelistv5
Published
2023-09-27 17:11
Modified
2024-10-23 19:39
Severity ?
EPSS score ?
Summary
A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled.
This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Cisco | Cisco SD-WAN vManage |
Version: 17.2.6 Version: 17.2.7 Version: 17.2.8 Version: 17.2.9 Version: 17.2.10 Version: 17.2.4 Version: 17.2.5 Version: 18.3.1.1 Version: 18.3.3.1 Version: 18.3.3 Version: 18.3.4 Version: 18.3.5 Version: 18.3.7 Version: 18.3.8 Version: 18.3.6.1 Version: 18.3.1 Version: 18.3.0 Version: 18.4.0.1 Version: 18.4.3 Version: 18.4.302 Version: 18.4.303 Version: 18.4.4 Version: 18.4.5 Version: 18.4.0 Version: 18.4.1 Version: 18.4.6 Version: 19.2.0 Version: 19.2.097 Version: 19.2.099 Version: 19.2.1 Version: 19.2.2 Version: 19.2.3 Version: 19.2.31 Version: 19.2.929 Version: 19.2.4 Version: 20.1.1.1 Version: 20.1.12 Version: 20.1.1 Version: 20.1.2 Version: 20.1.3 Version: 19.3.0 Version: 19.1.0 Version: 18.2.0 Version: 20.3.1 Version: 20.3.2 Version: 20.3.2.1 Version: 20.3.3 Version: 20.3.3.1 Version: 20.3.4 Version: 20.3.4.1 Version: 20.3.4.2 Version: 20.3.5 Version: 20.3.6 Version: 20.3.7 Version: 20.3.7.1 Version: 20.3.4.3 Version: 20.3.5.1 Version: 20.3.7.2 Version: 20.4.1 Version: 20.4.1.1 Version: 20.4.1.2 Version: 20.4.2 Version: 20.4.2.2 Version: 20.4.2.1 Version: 20.4.2.3 Version: 20.5.1 Version: 20.5.1.2 Version: 20.5.1.1 Version: 20.6.1 Version: 20.6.1.1 Version: 20.6.2.1 Version: 20.6.2.2 Version: 20.6.2 Version: 20.6.3 Version: 20.6.3.1 Version: 20.6.1.2 Version: 20.6.3.2 Version: 20.6.3.3 Version: 20.6.3.0.45 Version: 20.6.3.0.46 Version: 20.6.3.0.47 Version: 20.7.1 Version: 20.7.1.1 Version: 20.7.2 Version: 20.8.1 Version: 20.9.1 Version: 20.9.2 Version: 20.9.2.1 Version: 20.9.3 Version: 20.9.3.1 Version: 20.9.2.3 Version: 20.9.3.0.12 Version: 20.9.3.0.16 Version: 20.9.3.0.17 Version: 20.9.3.0.18 Version: 20.9.3.0.20 Version: 20.9.3.0.21 Version: 20.9.3.0.23 Version: 20.10.1 Version: 20.10.1.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T09:05:36.889Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "cisco-sa-sdwan-vman-sc-LRLfu2z", tags: [ "x_transferred", ], url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "catalyst_sd-wan_manager", vendor: "cisco", versions: [ { lessThanOrEqual: "20.9.3.1", status: "affected", version: "17.2.10", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-20254", options: [ { Exploitation: "None", }, { Automatable: "No", }, { "Technical Impact": "Total", }, ], role: "CISA Coordinator", timestamp: "2023-11-15T16:37:43.965360Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-23T19:39:16.225Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "Cisco SD-WAN vManage", vendor: "Cisco", versions: [ { status: "affected", version: "17.2.6", }, { status: "affected", version: "17.2.7", }, { status: "affected", version: "17.2.8", }, { status: "affected", version: "17.2.9", }, { status: "affected", version: "17.2.10", }, { status: "affected", version: "17.2.4", }, { status: "affected", version: "17.2.5", }, { status: "affected", version: "18.3.1.1", }, { status: "affected", version: "18.3.3.1", }, { status: "affected", version: "18.3.3", }, { status: "affected", version: "18.3.4", }, { status: "affected", version: "18.3.5", }, { status: "affected", version: "18.3.7", }, { status: "affected", version: "18.3.8", }, { status: "affected", version: "18.3.6.1", }, { status: "affected", version: "18.3.1", }, { status: "affected", version: "18.3.0", }, { status: "affected", version: "18.4.0.1", }, { status: "affected", version: "18.4.3", }, { status: "affected", version: "18.4.302", }, { status: "affected", version: "18.4.303", }, { status: "affected", version: "18.4.4", }, { status: "affected", version: "18.4.5", }, { status: "affected", version: "18.4.0", }, { status: "affected", version: "18.4.1", }, { status: "affected", version: "18.4.6", }, { status: "affected", version: "19.2.0", }, { status: "affected", version: "19.2.097", }, { status: "affected", version: "19.2.099", }, { status: "affected", version: "19.2.1", }, { status: "affected", version: "19.2.2", }, { status: "affected", version: "19.2.3", }, { status: "affected", version: "19.2.31", }, { status: "affected", version: "19.2.929", }, { status: "affected", version: "19.2.4", }, { status: "affected", version: "20.1.1.1", }, { status: "affected", version: "20.1.12", }, { status: "affected", version: "20.1.1", }, { status: "affected", version: "20.1.2", }, { status: "affected", version: "20.1.3", }, { status: "affected", version: "19.3.0", }, { status: "affected", version: "19.1.0", }, { status: "affected", version: "18.2.0", }, { status: "affected", version: "20.3.1", }, { status: "affected", version: "20.3.2", }, { status: "affected", version: "20.3.2.1", }, { status: "affected", version: "20.3.3", }, { status: "affected", version: "20.3.3.1", }, { status: "affected", version: "20.3.4", }, { status: "affected", version: "20.3.4.1", }, { status: "affected", version: "20.3.4.2", }, { status: "affected", version: "20.3.5", }, { status: "affected", version: "20.3.6", }, { status: "affected", version: "20.3.7", }, { status: "affected", version: "20.3.7.1", }, { status: "affected", version: "20.3.4.3", }, { status: "affected", version: "20.3.5.1", }, { status: "affected", version: "20.3.7.2", }, { status: "affected", version: "20.4.1", }, { status: "affected", version: "20.4.1.1", }, { status: "affected", version: "20.4.1.2", }, { status: "affected", version: "20.4.2", }, { status: "affected", version: "20.4.2.2", }, { status: "affected", version: "20.4.2.1", }, { status: "affected", version: "20.4.2.3", }, { status: "affected", version: "20.5.1", }, { status: "affected", version: "20.5.1.2", }, { status: "affected", version: "20.5.1.1", }, { status: "affected", version: "20.6.1", }, { status: "affected", version: "20.6.1.1", }, { status: "affected", version: "20.6.2.1", }, { status: "affected", version: "20.6.2.2", }, { status: "affected", version: "20.6.2", }, { status: "affected", version: "20.6.3", }, { status: "affected", version: "20.6.3.1", }, { status: "affected", version: "20.6.1.2", }, { status: "affected", version: "20.6.3.2", }, { status: "affected", version: "20.6.3.3", }, { status: "affected", version: "20.6.3.0.45", }, { status: "affected", version: "20.6.3.0.46", }, { status: "affected", version: "20.6.3.0.47", }, { status: "affected", version: "20.7.1", }, { status: "affected", version: "20.7.1.1", }, { status: "affected", version: "20.7.2", }, { status: "affected", version: "20.8.1", }, { status: "affected", version: "20.9.1", }, { status: "affected", version: "20.9.2", }, { status: "affected", version: "20.9.2.1", }, { status: "affected", version: "20.9.3", }, { status: "affected", version: "20.9.3.1", }, { status: "affected", version: "20.9.2.3", }, { status: "affected", version: "20.9.3.0.12", }, { status: "affected", version: "20.9.3.0.16", }, { status: "affected", version: "20.9.3.0.17", }, { status: "affected", version: "20.9.3.0.18", }, { status: "affected", version: "20.9.3.0.20", }, { status: "affected", version: "20.9.3.0.21", }, { status: "affected", version: "20.9.3.0.23", }, { status: "affected", version: "20.10.1", }, { status: "affected", version: "20.10.1.1", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled.\r\n\r This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.", }, ], exploits: [ { lang: "en", value: "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.2, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, format: "cvssV3_1", }, ], providerMetadata: { dateUpdated: "2024-01-25T16:58:33.089Z", orgId: "d1c1063e-7a18-46af-9102-31f8928bc633", shortName: "cisco", }, references: [ { name: "cisco-sa-sdwan-vman-sc-LRLfu2z", url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z", }, ], source: { advisory: "cisco-sa-sdwan-vman-sc-LRLfu2z", defects: [ "CSCwf68936", "CSCwf55823", ], discovery: "INTERNAL", }, }, }, cveMetadata: { assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633", assignerShortName: "cisco", cveId: "CVE-2023-20254", datePublished: "2023-09-27T17:11:23.280Z", dateReserved: "2022-10-27T18:47:50.372Z", dateUpdated: "2024-10-23T19:39:16.225Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2023-20254\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2023-09-27T18:15:11.690\",\"lastModified\":\"2024-11-21T07:41:00.253\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled.\\r\\n\\r This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en el sistema de gestión de sesiones de la función multiinquilino de Cisco Catalyst SD-WAN Manager podría permitir que un atacante remoto autenticado acceda a otro tenant que está siendo administrado por la misma instancia de Cisco Catalyst SD-WAN Manager. Esta vulnerabilidad requiere que esté habilitada la función multi-tenant. Esta vulnerabilidad se debe a una gestión insuficiente de la sesión de usuario dentro del sistema Cisco Catalyst SD-WAN Manager. Un atacante podría aprovechar esta vulnerabilidad enviando una solicitud manipulada a un sistema afectado. Un exploit exitoso podría permitir al atacante obtener acceso no autorizado a información sobre otro tenant, realizar cambios en la configuración o posiblemente desconectar a un tenant, provocando una condición de denegación de servicio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"20.6.3.4\",\"matchCriteriaId\":\"E6BF7AEE-61BF-488D-8439-35B85529DD45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.7\",\"versionEndExcluding\":\"20.9.3.2\",\"matchCriteriaId\":\"DFA494E8-5817-49FF-AF87-C1E5CC6A366B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.10\",\"versionEndExcluding\":\"20.10.1.2\",\"matchCriteriaId\":\"DB339115-6B31-4A04-89BC-A053C964CDD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:sd-wan_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"20.11\",\"versionEndExcluding\":\"20.11.1.2\",\"matchCriteriaId\":\"FD884D68-559B-4169-9790-D8C6F694593E\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}", vulnrichment: { containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z\", \"name\": \"cisco-sa-sdwan-vman-sc-LRLfu2z\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T09:05:36.889Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-20254\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"None\"}, {\"Automatable\": \"No\"}, {\"Technical Impact\": \"Total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2023-11-15T16:37:43.965360Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*\"], \"vendor\": \"cisco\", \"product\": \"catalyst_sd-wan_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.2.10\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"20.9.3.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-23T19:25:28.465Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwf68936\", \"CSCwf55823\"], \"advisory\": \"cisco-sa-sdwan-vman-sc-LRLfu2z\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco SD-WAN vManage\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.2.6\"}, {\"status\": \"affected\", \"version\": \"17.2.7\"}, {\"status\": \"affected\", \"version\": \"17.2.8\"}, {\"status\": \"affected\", \"version\": \"17.2.9\"}, {\"status\": \"affected\", \"version\": \"17.2.10\"}, {\"status\": \"affected\", \"version\": \"17.2.4\"}, {\"status\": \"affected\", \"version\": \"17.2.5\"}, {\"status\": \"affected\", \"version\": \"18.3.1.1\"}, {\"status\": \"affected\", \"version\": \"18.3.3.1\"}, {\"status\": \"affected\", \"version\": \"18.3.3\"}, {\"status\": \"affected\", \"version\": \"18.3.4\"}, {\"status\": \"affected\", \"version\": \"18.3.5\"}, {\"status\": \"affected\", \"version\": \"18.3.7\"}, {\"status\": \"affected\", \"version\": \"18.3.8\"}, {\"status\": \"affected\", \"version\": \"18.3.6.1\"}, {\"status\": \"affected\", \"version\": \"18.3.1\"}, {\"status\": \"affected\", \"version\": \"18.3.0\"}, {\"status\": \"affected\", \"version\": \"18.4.0.1\"}, {\"status\": \"affected\", \"version\": \"18.4.3\"}, {\"status\": \"affected\", \"version\": \"18.4.302\"}, {\"status\": \"affected\", \"version\": \"18.4.303\"}, {\"status\": \"affected\", \"version\": \"18.4.4\"}, {\"status\": \"affected\", \"version\": \"18.4.5\"}, {\"status\": \"affected\", \"version\": \"18.4.0\"}, {\"status\": \"affected\", \"version\": \"18.4.1\"}, {\"status\": \"affected\", \"version\": \"18.4.6\"}, {\"status\": \"affected\", \"version\": \"19.2.0\"}, {\"status\": \"affected\", \"version\": \"19.2.097\"}, {\"status\": \"affected\", \"version\": \"19.2.099\"}, {\"status\": \"affected\", \"version\": \"19.2.1\"}, {\"status\": \"affected\", \"version\": \"19.2.2\"}, {\"status\": \"affected\", \"version\": \"19.2.3\"}, {\"status\": \"affected\", \"version\": \"19.2.31\"}, {\"status\": \"affected\", \"version\": \"19.2.929\"}, {\"status\": \"affected\", \"version\": \"19.2.4\"}, {\"status\": \"affected\", \"version\": \"20.1.1.1\"}, {\"status\": \"affected\", \"version\": \"20.1.12\"}, {\"status\": \"affected\", \"version\": \"20.1.1\"}, {\"status\": \"affected\", \"version\": \"20.1.2\"}, {\"status\": \"affected\", \"version\": \"20.1.3\"}, {\"status\": \"affected\", \"version\": \"19.3.0\"}, {\"status\": \"affected\", \"version\": \"19.1.0\"}, {\"status\": \"affected\", \"version\": \"18.2.0\"}, {\"status\": \"affected\", \"version\": \"20.3.1\"}, {\"status\": \"affected\", \"version\": \"20.3.2\"}, {\"status\": \"affected\", \"version\": \"20.3.2.1\"}, {\"status\": \"affected\", \"version\": \"20.3.3\"}, {\"status\": \"affected\", \"version\": \"20.3.3.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4\"}, {\"status\": \"affected\", \"version\": \"20.3.4.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.2\"}, {\"status\": \"affected\", \"version\": \"20.3.5\"}, {\"status\": \"affected\", \"version\": \"20.3.6\"}, {\"status\": \"affected\", \"version\": \"20.3.7\"}, {\"status\": \"affected\", \"version\": \"20.3.7.1\"}, {\"status\": \"affected\", \"version\": \"20.3.4.3\"}, {\"status\": \"affected\", \"version\": \"20.3.5.1\"}, {\"status\": \"affected\", \"version\": \"20.3.7.2\"}, {\"status\": \"affected\", \"version\": \"20.4.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.1\"}, {\"status\": \"affected\", \"version\": \"20.4.1.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2.2\"}, {\"status\": \"affected\", \"version\": \"20.4.2.1\"}, {\"status\": \"affected\", \"version\": \"20.4.2.3\"}, {\"status\": \"affected\", \"version\": \"20.5.1\"}, {\"status\": \"affected\", \"version\": \"20.5.1.2\"}, {\"status\": \"affected\", \"version\": \"20.5.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.1\"}, {\"status\": \"affected\", \"version\": \"20.6.1.1\"}, {\"status\": \"affected\", \"version\": \"20.6.2.1\"}, {\"status\": \"affected\", \"version\": \"20.6.2.2\"}, {\"status\": \"affected\", \"version\": \"20.6.2\"}, {\"status\": \"affected\", \"version\": \"20.6.3\"}, {\"status\": \"affected\", \"version\": \"20.6.3.1\"}, {\"status\": \"affected\", \"version\": \"20.6.1.2\"}, {\"status\": \"affected\", \"version\": \"20.6.3.2\"}, {\"status\": \"affected\", \"version\": \"20.6.3.3\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.45\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.46\"}, {\"status\": \"affected\", \"version\": \"20.6.3.0.47\"}, {\"status\": \"affected\", \"version\": \"20.7.1\"}, {\"status\": \"affected\", \"version\": \"20.7.1.1\"}, {\"status\": \"affected\", \"version\": \"20.7.2\"}, {\"status\": \"affected\", \"version\": \"20.8.1\"}, {\"status\": \"affected\", \"version\": \"20.9.1\"}, {\"status\": \"affected\", \"version\": \"20.9.2\"}, {\"status\": \"affected\", \"version\": \"20.9.2.1\"}, {\"status\": \"affected\", \"version\": \"20.9.3\"}, {\"status\": \"affected\", \"version\": \"20.9.3.1\"}, {\"status\": \"affected\", \"version\": \"20.9.2.3\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.12\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.16\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.17\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.18\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.20\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.21\"}, {\"status\": \"affected\", \"version\": \"20.9.3.0.23\"}, {\"status\": \"affected\", \"version\": \"20.10.1\"}, {\"status\": \"affected\", \"version\": \"20.10.1.1\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z\", \"name\": \"cisco-sa-sdwan-vman-sc-LRLfu2z\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled.\\r\\n\\r This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.\"}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2024-01-25T16:58:33.089Z\"}}}", cveMetadata: "{\"cveId\": \"CVE-2023-20254\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-23T19:39:16.225Z\", \"dateReserved\": \"2022-10-27T18:47:50.372Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2023-09-27T17:11:23.280Z\", \"assignerShortName\": \"cisco\"}", dataType: "CVE_RECORD", dataVersion: "5.1", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.