A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.4 |
25 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CPE | cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.11:*:*:*:*:*:*:* |
17 May 2023, 18:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vmanage-wfnqmYhN - Vendor Advisory | |
| References | (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-5j43-q336-92ch - Exploit, Third Party Advisory | |
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.0 |
| CPE | cpe:2.3:a:cisco:sd-wan_vmanage:20.11:*:*:*:*:*:*:* cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:* |
09 May 2023, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-09 18:15
Updated : 2024-11-21 07:40
NVD link : CVE-2023-20098
Mitre link : CVE-2023-20098
CVE.ORG link : CVE-2023-20098
JSON object : View
Products Affected
cisco
- catalyst_sd-wan_manager
- sd-wan_vmanage