CVE-2023-20184

CWE-285CWE-552 — Files Accessible to External PartiesCWE-78 — OS Command Injection4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 62.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Catalyst CenterCisco Cisco Digital Network Architecture Center (dna Center)
Timeline
PublishedMay 18

Description

Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root user. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶NVDcisco/catalyst_center< 2.2.3.5

🔴Vulnerability Details

2
GHSA
GHSA-r7fv-7h5m-jcwv: Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted c↗2023-05-18
▶
CVEList
Cisco DNA Center Software API Vulnerabilities↗2023-05-18
▶

📋Vendor Advisories

1
Cisco
Cisco DNA Center Software API Vulnerabilities↗2023-05-17
▶