PT-2023-4616 · Cisco · Cisco Intersight Virtual Appliance

Andrew Kim · Publicado 2023-08-16 · Atualizado 2024-01-25 · CVE-2023-20237

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Intersight Virtual Appliance (affected versions not specified)

Description A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible. This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Improper Access Control

Enumeração de Fraquezas

CWE-77

CWE-284

Identificadores relacionados

BDU:2023-05023

CVE-2023-20237

Produtos afetados

Cisco Intersight Virtual Appliance

Referências · 10

• https://twitter.com/CVEnew/status/1691921016144953461 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1691871833463693601 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-20237 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05023 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023082435 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-20237 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ivpa-cmdinj-C5XRbbOy · Aviso do Fabricante
• https://t.me/cvenotify/56681 · Publicação no Telegram
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb · Aviso do Fabricante
• https://t.me/cibsecurity/68703 · Publicação no Telegram