CVE-2020-3229 — Incorrect Authorization in Cisco IOS XE Software 16.2.2

CWE-264CWE-863 — Incorrect Authorization9 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.8%
top 26.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE Software 16.2.2Cisco IOS XE
Timeline
PublishedJun 3
Latest updateOct 27

Description

A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a Read-Only user to execute CLI commands or config…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/ios_xe83 versions+82

Patches

Patch: tools.cisco.com ↗Patch: tools.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gffh-92vm-w5gf: A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remot↗2022-05-24
▶
CVEList
Cisco IOS XE Software Web UI Privilege Escalation Vulnerability↗2020-06-03
▶

📋Vendor Advisories

2
CISA ICS
Rockwell Automation Stratix Devices Containing Cisco IOS↗2022-10-27
▶
Cisco
Cisco IOS XE Software Web UI Privilege Escalation Vulnerability↗2020-06-03
▶

💬Community

1
Bugzilla
CVE-2020-15652 Mozilla: Potential leak of redirect targets when loading scripts in a worker↗2020-07-29
▶
CVE-2020-3229 — Incorrect Authorization in Cisco | cvebase