Sign-up

ID

VAR-202304-2153


CVE

CVE-2023-20098


TITLE

Cisco Systems  Cisco Catalyst SD-WAN Manager  and  Cisco SD-WAN vManage  Past traversal vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-010317

DESCRIPTION

A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root. Cisco Systems Cisco Catalyst SD-WAN Manager and Cisco SD-WAN vManage Exists in a past traversal vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN

Trust: 1.71

sources: NVD: CVE-2023-20098 // JVNDB: JVNDB-2023-010317 // VULMON: CVE-2023-20098

AFFECTED PRODUCTS

vendor:ciscomodel:sd-wan vmanagescope:ltversion:20.9.1

Trust: 1.0

vendor:ciscomodel:catalyst sd-wan managerscope:eqversion:20.11

Trust: 1.0

vendor:シスコシステムズmodel:cisco catalyst sd-wan managerscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco sd-wan vmanagescope:eqversion:20.9.1

Trust: 0.8

sources: JVNDB: JVNDB-2023-010317 // NVD: CVE-2023-20098

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-20098
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2023-20098
value: MEDIUM

Trust: 1.0

NVD: CVE-2023-20098
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202305-762
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2023-20098
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2023-20098
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2023-20098
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-010317 // CNNVD: CNNVD-202305-762 // NVD: CVE-2023-20098 // NVD: CVE-2023-20098

PROBLEMTYPE DATA

problemtype:CWE-24

Trust: 1.0

problemtype:CWE-22

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-010317 // NVD: CVE-2023-20098

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202305-762

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202305-762

PATCH

title:cisco-sa-sdwan-vmanage-wfnqmYhNurl:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN

Trust: 0.8

title:Cisco SD-WAN vManage Repair measures for path traversal vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=238056

Trust: 0.6

title:Cisco: Cisco SD-WAN vManage Software Arbitrary File Deletion Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-sdwan-vmanage-wfnqmYhN

Trust: 0.1

sources: VULMON: CVE-2023-20098 // JVNDB: JVNDB-2023-010317 // CNNVD: CNNVD-202305-762

EXTERNAL IDS

db:NVDid:CVE-2023-20098

Trust: 3.3

db:JVNDBid:JVNDB-2023-010317

Trust: 0.8

db:CNNVDid:CNNVD-202305-762

Trust: 0.6

db:VULMONid:CVE-2023-20098

Trust: 0.1

sources: VULMON: CVE-2023-20098 // JVNDB: JVNDB-2023-010317 // CNNVD: CNNVD-202305-762 // NVD: CVE-2023-20098

REFERENCES

url:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sdwan-vmanage-wfnqmyhn

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2023-20098

Trust: 1.4

url:https://github.com/orangecertcc/security-research/security/advisories/ghsa-5j43-q336-92ch

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2023-20098/

Trust: 0.6

sources: VULMON: CVE-2023-20098 // JVNDB: JVNDB-2023-010317 // CNNVD: CNNVD-202305-762 // NVD: CVE-2023-20098

SOURCES

db:VULMONid:CVE-2023-20098
db:JVNDBid:JVNDB-2023-010317
db:CNNVDid:CNNVD-202305-762
db:NVDid:CVE-2023-20098

LAST UPDATE DATE

2024-08-14T14:17:14.436000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2023-010317date:2023-12-08T05:51:00
db:CNNVDid:CNNVD-202305-762date:2023-05-18T00:00:00
db:NVDid:CVE-2023-20098date:2024-01-25T17:15:29.463

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2023-010317date:2023-12-08T00:00:00
db:CNNVDid:CNNVD-202305-762date:2023-05-09T00:00:00
db:NVDid:CVE-2023-20098date:2023-05-09T18:15:11.760