Cisco Intersight Private Virtual Appliance RootLevel Command Exec via Upload
CVE-2023-20017 Published on August 16, 2023
Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities. These vulnerabilities are due to insufficient input validation when extracting uploaded software packages. An attacker could exploit these vulnerabilities by authenticating to an affected device and uploading a crafted software package. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
Vulnerability Analysis
CVE-2023-20017 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2023-20017 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2023-20017
Want to know whenever a new CVE is published for Cisco Intersight Private Virtual Appliance? stack.watch will email you.
Affected Versions
Cisco Intersight Virtual Appliance:- Version 1.0.9-113 is affected.
- Version 1.0.9-148 is affected.
- Version 1.0.9-230 is affected.
- Version 1.0.9-53 is affected.
- Version 1.0.9-7 is affected.
- Version 1.0.9-197 is affected.
- Version 1.0.9-170 is affected.
- Version 1.0.9-149 is affected.
- Version 1.0.9-278 is affected.
- Version 1.0.9-184 is affected.
- Version 1.0.9-232 is affected.
- Version 1.0.9-83 is affected.
- Version 1.0.9-90 is affected.
- Version 1.0.9-97 is affected.
- Version 1.0.9-125 is affected.
- Version 1.0.9-250 is affected.
- Version 1.0.9-77 is affected.
- Version 1.0.9-133 is affected.
- Version 1.0.9-67 is affected.
- Version 1.0.9-214 is affected.
- Version 1.0.9-103 is affected.
- Version 1.0.9-266 is affected.
- Version 1.0.9-13 is affected.
- Version 1.0.9-164 is affected.
- Version 1.0.9-292 is affected.
- Version 1.0.9-302 is affected.
- Version 1.0.9-319 is affected.
- Version 1.0.9-343 is affected.
- Version 1.0.9-360 is affected.
- Version 1.0.9-361 is affected.
- Version 1.0.9-378 is affected.
- Version 1.0.9-389 is affected.
- Version 1.0.9-402 is affected.
- Version 1.0.9-428 is affected.
- Version 1.0.9-442 is affected.
- Version 1.0.9-456 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.