CVE-2023-24546 — Improper Access Control in Cloudvision Portal

CWE-284 — Improper Access ControlCWE-863 — Incorrect Authorization3 documents3 sources
Severity
8.1HIGHNVD
EPSS
0.2%
top 62.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Arista Cloudvision Portal
Timeline
PublishedJun 13

Description

On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDarista/cloudvision_portal2021.1 — 2021.3+5
▶CVEListV5arista/cloudvision_portal<2021.1.0, <2021.2.0, <2021.3.0,

🔴Vulnerability Details

2
GHSA
GHSA-hww7-wgc5-5m95: On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor w↗2023-06-13
▶
CVEList
CVE-2023-24546: On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor w↗2023-06-13
▶
CVE-2023-24546 — Improper Access Control | cvebase