CVE-2023-20237CWE-284

A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise…

Medium · published August 16, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible.

This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker access to internal subnets beyond the sphere of their intended access level.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-08-16T21:00Z
EPSS history
Timeline
  • 16 AUG 21:00Z
    A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise…
    cvelistv5