Session Management Vulnerability in Cisco Catalyst SD-WAN Manager

CVE-2023-20254

What is CVE-2023-20254?

A security flaw exists in the session management system of the Cisco Catalyst SD-WAN Manager's multi-tenant feature. An authenticated attacker, leveraging this vulnerability, could exploit insufficient user session management to gain unauthorized access to another tenant managed by the same Cisco Catalyst SD-WAN Manager instance. By sending specially crafted requests to the affected system, the attacker might obtain sensitive information, implement unauthorized configuration changes, or lead to potential service disruptions, thereby impacting tenant operations.

References