CVE-2023-20252
published 2023-09-27CVE-2023-20252: A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.06%
60.7th percentile
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user.
This vulnerability is due to improper authentication checks for SAML APIs. An attacker could exploit this vulnerability by sending requests directly to the SAML API. A successful exploit could allow the attacker to generate an authorization token sufficient to gain access to the application.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | catalyst_sd-wan_manager | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
| cisco | cisco_sd-wan_vmanage | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated requests sent directly to the SAML API endpoint of Cisco Catalyst SD-WAN Manager, which may indicate exploitation of CVE-2023-20252 ↗
- →Monitor for generation of unexpected or arbitrary authorization tokens following SAML API requests on Cisco Catalyst SD-WAN Manager, as successful exploitation results in a valid auth token being issued without proper authentication ↗
- →Focus detection on Cisco Catalyst SD-WAN Manager versions 20.9.3.2 and 20.11.1.2 specifically, as these are the only confirmed vulnerable releases for CVE-2023-20252 ↗
- ·IOS XE Software, SD-WAN cEdge Routers, and SD-WAN vEdge Routers are NOT affected by CVE-2023-20252; scope detection exclusively to Cisco Catalyst SD-WAN Manager (formerly vManage) ↗
- ·CVE-2023-20252 only affects specific point releases (20.9.3.2 and 20.11.1.2); older releases within the 20.9 and 20.11 branches and the 20.12 branch (except medium-severity CVE-2023-20262) are not impacted — tune version-based detections accordingly to avoid false positives ↗
- ·There are no vendor-provided workarounds for CVE-2023-20252; detection/mitigation strategies cannot rely on a configuration-based fix — patching to a fixed release is the only remediation ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_cisco9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Catalyst SD-WAN Manager Vulnerabilities
vendor_cisco·2023-09-27·CVSS 9.8
CVE-2023-20034 [CRITICAL] CWE-286 Cisco Catalyst SD-WAN Manager Vulnerabilities
Cisco Catalyst SD-WAN Manager Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z
Cisco
Cisco Catalyst SD-WAN Manager Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20252 Cisco Catalyst SD-WAN Manager Vulnerabilities
CVE-2023-20252: Cisco Catalyst SD-WAN Manager Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-286, CWE-399, CWE-798, CWE-286, CWE-399, CWE-798, CWE-862, CWE-286, CWE-399, CWE-798, CWE-286, CWE-399, CWE-798, CWE-862
Bug IDs: CSCvw59643, CSCvz62234, CSCwd46383, CSCvw59643, CSCvz62234
GHSA
GHSA-rjvr-rwwj-qxq2: A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote
ghsa_unreviewed·2023-09-27
CVE-2023-20252 [CRITICAL] CWE-287 GHSA-rjvr-rwwj-qxq2: A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user.
This vulnerability is due to improper authentication checks for SAML APIs. An attacker could exploit this vulnerability by sending requests directly to the SAML API. A successful exploit could allow the attacker to generate an authorization token sufficient to gain access to the application.
No detection rules found.
No public exploits indexed.
2023-09-27
Published