PT-2023-4432 · Cisco · Cisco Duo Device Health Application

CVE-2023-20229 · Publicado 2023-08-16 · Atualizado 2024-03-21

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Duo Device Health Application for Windows (affected versions not specified)

Description A vulnerability in the CryptoService function could allow an authenticated, local attacker with low privileges to conduct directory traversal attacks and overwrite arbitrary files on an affected system. This issue is due to insufficient input validation, allowing an attacker to exploit the vulnerability by executing a directory traversal attack. A successful exploit could result in a denial of service (DoS) condition or data loss on the affected system, as an attacker could use a cryptographic key to overwrite arbitrary files with SYSTEM-level privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-04777

CVE-2023-20229

Produtos afetados

Cisco Duo Device Health Application

Referências · 10

• https://twitter.com/CVEnew/status/1691931060102218044 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-20229 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04777 · Nota de Segurança
• https://t.me/cibsecurity/68720 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-20229 · Nota de Segurança
• https://twitter.com/SecurityAid/status/1770799202727051381 · Publicação no Twitter
• https://twitter.com/fletch_ai/status/1692387783157989824 · Publicação no Twitter
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-dha-filewrite-xPMBMZAK · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1691872086422139126 · Publicação no Twitter
• https://t.me/cvenotify/56683 · Publicação no Telegram