Insufficient Access Restrictions in Cisco Intersight Virtual Appliance
CVE-2023-20237

4.3MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Intersight Virtual Appliance
Vendor
CVE Published:
16 August 2023

What is CVE-2023-20237?

A vulnerability in Cisco Intersight Virtual Appliance could enable an unauthenticated attacker to exploit internal HTTP services that should remain secure. This issue is rooted in insufficient restrictions on internal HTTP proxies, allowing a potential attacker to submit a crafted CLI command. If successfully exploited, the attacker can gain access to internal subnets that extend beyond their designated access privileges, thereby compromising the system's integrity and confidentiality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Cisco Intersight Virtual Appliance 1.0.9-503

Cisco Intersight Virtual Appliance 1.0.9-536

Cisco Intersight Virtual Appliance 1.0.9-538

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.