PT-2023-3373 · Cisco · Cisco Duo Two-Factor Authentication For Macos

Publicado 2023-06-21 · Atualizado 2023-07-06 · CVE-2023-20199

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Duo Two-Factor Authentication for macOS (affected versions not specified)

Description A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This issue is due to the incorrect handling of responses from Cisco Duo when the application is configured to fail open. An attacker with primary user credentials could exploit this by attempting to authenticate to an affected device, potentially allowing access to the device without valid permission.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2023-03530

CVE-2023-20199

Produtos afetados

Cisco Duo Two-Factor Authentication For Macos

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-20199 · Nota de Segurança
• https://t.me/cibsecurity/65618 · Publicação no Telegram
• https://cybersecurity-help.cz/vdb/SB2023062216 · Nota
• https://bdu.fstec.ru/vul/2023-03530 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20199 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-mac-bypass-OyZpVPnx · Aviso do Fabricante
• https://vuldb.com/?id.232099 · Nota