CVE-2022-20958 — Absolute Path Traversal in Cisco Broadworks Commpilot Application

CWE-36 — Absolute Path TraversalCWE-918 — Server-Side Request ForgeryCWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGHNVD
CNA8.3
EPSS
2.2%
top 15.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Broadworks Commpilot ApplicationCisco Broadworks
Timeline
PublishedNov 4

Description

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco/cisco_broadworks1272 versions+1271

🔴Vulnerability Details

2
GHSA
GHSA-4w9w-3v73-2rh7: A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to per↗2022-11-04
▶
CVEList
CVE-2022-20958: A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to per↗2022-11-03
▶

📋Vendor Advisories

1
Cisco
Cisco BroadWorks CommPilot Application Software Vulnerabilities↗2022-11-02
▶
CVE-2022-20958 — Absolute Path Traversal in Cisco | cvebase