Insufficient Access Restrictions in Cisco Intersight Virtual Appliance

CVE-2023-20237

Summary

A vulnerability in Cisco Intersight Virtual Appliance could enable an unauthenticated attacker to exploit internal HTTP services that should remain secure. This issue is rooted in insufficient restrictions on internal HTTP proxies, allowing a potential attacker to submit a crafted CLI command. If successfully exploited, the attacker can gain access to internal subnets that extend beyond their designated access privileges, thereby compromising the system's integrity and confidentiality.

References