PT-2023-4616 · Cisco · Cisco Intersight Virtual Appliance

Andrew Kim · Published 2023-08-16 · Updated 2024-01-25 · CVE-2023-20237

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Intersight Virtual Appliance (affected versions not specified)

Description A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible. This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Improper Access Control

Weakness Enumeration

CWE-77

CWE-284

Related Identifiers

BDU:2023-05023

CVE-2023-20237

Affected Products

Cisco Intersight Virtual Appliance

References · 10

• https://osv.dev/vulnerability/CVE-2023-20237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05023 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20237 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ivpa-cmdinj-C5XRbbOy · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb · Vendor Advisory
• https://twitter.com/CVEnew/status/1691921016144953461 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691871833463693601 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2023082435 · Note
• https://t.me/cvenotify/56681 · Telegram Post
• https://t.me/cibsecurity/68703 · Telegram Post