CVE-2022-20921 — Improper Authorization in Cisco ACI Multi-site Orchestrator

CWE-285 — Improper Authorization4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 32.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco ACI Multi-site OrchestratorCisco ACI Multi-site Orchestrator Software
Timeline
PublishedAug 25
Latest updateAug 26

Description

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sending crafted HTTP requests. A successful exploit could allow an attacker who is authenticated with non-Administrator privileges to elevate to Administrator privileges on an affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-mxh3-24xj-7crf: A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileg↗2022-08-26
▶
CVEList
Cisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability↗2022-08-25
▶

📋Vendor Advisories

1
Cisco
Cisco ACI Multi-Site Orchestrator Privilege Escalation Vulnerability↗2022-08-24
▶
CVE-2022-20921 — Improper Authorization in Cisco | cvebase