CVE-2023-20154
published 2024-11-15CVE-2023-20154: A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface…
PriorityP358high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.90%
55.0th percentile
A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.
This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerability, the attacker would need valid user credentials that are stored on the associated external authentication server.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_modeling_labs | — | — |
| cisco | cisco_modeling_labs | — | — |
| cisco | cisco_modeling_labs | — | — |
| cisco | cisco_modeling_labs | — | — |
| cisco | cisco_modeling_labs | — | — |
| cisco | modeling_labs | >= 2.3 < 2.5.1 | 2.5.1 |
| cisco | modeling_labs_external | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_cisco9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Modeling Labs External Authentication Bypass Vulnerability
vendor_cisco·2023-04-19·CVSS 9.1
CVE-2023-20154 [CRITICAL] CWE-305 Cisco Modeling Labs External Authentication Bypass Vulnerability
Cisco Modeling Labs External Authentication Bypass Vulnerability
A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.
This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify ever
Cisco
Cisco Modeling Labs External Authentication Bypass Vulnerability
vendor_cisco·CVSS 3.1
CVE-2023-20154 Cisco Modeling Labs External Authentication Bypass Vulnerability
CVE-2023-20154: Cisco Modeling Labs External Authentication Bypass Vulnerability
A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges. This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access a
GHSA
GHSA-g9gm-jgpx-56qm: A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web inte
ghsa_unreviewed·2024-11-15
CVE-2023-20154 [CRITICAL] CWE-305 GHSA-g9gm-jgpx-56qm: A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web inte
A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.
This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerabil
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-15
Published