Cisco Catalyst SD-WAN Auth File Retrieval via Web UI
CVE-2023-20261 Published on October 18, 2023

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user.

NVD

Vulnerability Analysis

CVE-2023-20261 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2023-20261 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2023-20261

Want to know whenever a new CVE is published for Cisco Catalyst Sd Wan Manager? stack.watch will email you.

Cisco Catalyst Sd Wan Manager
 

Affected Versions

Cisco SD-WAN vManage:

Exploit Probability

EPSS
0.12%
Percentile
31.42%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.