A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible.
This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
25 Aug 2023, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:cisco:intersight_connected_virtual_appliance:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_assist:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_private_virtual_appliance:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:intersight_virtual_appliance:*:*:*:*:*:*:*:* |
|
| CWE | CWE-77 | |
| First Time |
Cisco intersight Assist
Cisco intersight Private Virtual Appliance Cisco intersight Virtual Appliance Cisco intersight Connected Virtual Appliance Cisco |
|
| References | (MISC) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-intersight-forward-C45ncgqb - Patch, Vendor Advisory |
16 Aug 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-16 22:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-20237
Mitre link : CVE-2023-20237
CVE.ORG link : CVE-2023-20237
JSON object : View
Products Affected
cisco
- intersight_private_virtual_appliance
- intersight_assist
- intersight_connected_virtual_appliance
- intersight_virtual_appliance