mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-19 17:31:42 +00:00
131 lines
4.9 KiB
JSON
131 lines
4.9 KiB
JSON
{
|
|
"id": "CVE-2022-20844",
|
|
"sourceIdentifier": "ykramarz@cisco.com",
|
|
"published": "2022-09-30T19:15:11.987",
|
|
"lastModified": "2023-11-07T03:43:06.533",
|
|
"vulnStatus": "Modified",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Una vulnerabilidad en el mecanismo de autenticaci\u00f3n de Cisco Software-Defined Application Visibility and Control (SD-AVC) en Cisco vManage podr\u00eda permitir a un atacante remoto no autenticado acceder a la GUI de Cisco SD-AVC usando una combinaci\u00f3n est\u00e1tica predeterminada de nombre de usuario y contrase\u00f1a. Esta vulnerabilidad se presenta porque la GUI es accesible en instalaciones autoadministradas en la nube o en instalaciones de servidores locales de Cisco vManage. Un atacante podr\u00eda explotar esta vulnerabilidad al acceder a la GUI expuesta de Cisco SD-AVC. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante visualizar los nombres de los dispositivos gestionados, los registros de SD-AVC y las direcciones IP del servidor DNS de SD-AVC"
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.3,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 1.4
|
|
},
|
|
{
|
|
"source": "d1c1063e-7a18-46af-9102-31f8928bc633",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.3,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 1.4
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "d1c1063e-7a18-46af-9102-31f8928bc633",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:cisco:sd-wan:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "20.4.1",
|
|
"versionEndExcluding": "20.6.3",
|
|
"matchCriteriaId": "B924F9AC-46FE-4587-AA9D-1CB6102F2DE2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:cisco:sd-wan:20.3.4.1:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "0C2FBD6B-5E9B-49B6-9832-49721EC2A809"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:cisco:sd-wan:20.3.4.2:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "55592EA0-64B8-4B4E-9908-A1282DE1279E"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:cisco:sd-wan:20.3.5:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "12F6186F-0690-45B1-A22B-8331E2A4BF38"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:cisco:sd-wan:20.7.1:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "65439145-5E94-4FF7-BEB3-C80BA4E4602F"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdavc-ZA5fpXX2",
|
|
"source": "ykramarz@cisco.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |