PT-2023-2530 · Cisco · Cisco Sdwan Vmanage

Frederic Mezou · Publicado 2023-04-19 · Atualizado 2024-01-25 · CVE-2023-20098

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco SDWAN vManage Software (affected versions not specified)

Description A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This issue arises from improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file, potentially allowing the deletion of arbitrary files from the system, including files owned by root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-24

CWE-22

Identificadores relacionados

BDU:2023-02329

CVE-2023-20098

Produtos afetados

Cisco Sdwan Vmanage

Referências · 7

• 🔥 https://github.com/orangecertcc/security-research/security/advisories/GHSA-5j43-q336-92ch · Exploit
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN · Aviso do Fabricante
• https://t.me/cvenotify/59529 · Publicação no Telegram
• https://t.me/cibsecurity/63667 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20098 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-02329 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20098 · Aviso do Fabricante