CVE-2023-20039
published 2024-11-15CVE-2023-20039: A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data. This vulnerability is due to insufficient default file…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.20%
9.7th percentile
A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data.
This vulnerability is due to insufficient default file permissions that are applied to the application data directory. An attacker could exploit this vulnerability by accessing files in the application data directory. A successful exploit could allow the attacker to view sensitive information.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | cisco_industrial_network_director | — | — |
| cisco | industrial_network_director | < 1.11.3 | 1.11.3 |
| cisco | industrial_network_director | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_cisco9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Industrial Network Director Vulnerabilities
vendor_cisco·2023-04-19·CVSS 9.9
CVE-2023-20036 [CRITICAL] CWE-552 Cisco Industrial Network Director Vulnerabilities
Cisco Industrial Network Director Vulnerabilities
Multiple vulnerabilities in Cisco Industrial Network Director (IND) could allow an authenticated attacker to inject arbitrary operating system commands or access sensitive data.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-CAeLFk6V
Cisco
Cisco Industrial Network Director Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20039 Cisco Industrial Network Director Vulnerabilities
CVE-2023-20039: Cisco Industrial Network Director Vulnerabilities
Multiple vulnerabilities in Cisco Industrial Network Director (IND) could allow an authenticated attacker to inject arbitrary operating system commands or access sensitive data. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-552, CWE-78, CWE-552, CWE-78
Bug IDs: CSCwc29352, CSCwc29354, CSCwc29354, CSCwc29352
GHSA
GHSA-qw62-27cx-6cqg: A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data
ghsa_unreviewed·2024-11-15
CVE-2023-20039 [MEDIUM] CWE-552 GHSA-qw62-27cx-6cqg: A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data
A vulnerability in Cisco IND could allow an authenticated, local attacker to read application data.
This vulnerability is due to insufficient default file permissions that are applied to the application data directory. An attacker could exploit this vulnerability by accessing files in the application data directory. A successful exploit could allow the attacker to view sensitive information.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-15
Published