A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible.
This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
25 Aug 2023, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cisco:intersight_connected_virtual_appliance:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_assist:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_private_virtual_appliance:-:*:*:*:*:*:*:* |
|
| First Time |
Cisco intersight Private Virtual Appliance
Cisco intersight Connected Virtual Appliance Cisco Cisco intersight Virtual Appliance Cisco intersight Assist |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| References | (MISC) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb - Patch, Vendor Advisory | |
| CWE | CWE-77 |
16 Aug 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-16 22:15
Updated : 2024-01-25 17:15
NVD link : CVE-2023-20237
Mitre link : CVE-2023-20237
JSON object : View
Products Affected
cisco
- intersight_connected_virtual_appliance
- intersight_private_virtual_appliance
- intersight_assist
- intersight_virtual_appliance
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')