CVE-2023-20220

{"id": "CVE-2023-20220", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-11-01T18:15:09.523", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmdinj-bTEgufOX", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmdinj-bTEgufOX", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. To exploit these vulnerabilities, the attacker must have valid device credentials, but does not need Administrator privileges. These vulnerabilities are due to insufficient validation of user-supplied input for certain configuration options. An attacker could exploit these vulnerabilities by using crafted input within the device configuration GUI. A successful exploit could allow the attacker to execute arbitrary commands on the device, including on the underlying operating system, which could also affect the availability of the device."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web del software Cisco Firepower Management Center (FMC) podr\u00edan permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema operativo subyacente. Para aprovechar estas vulnerabilidades, el atacante debe tener credenciales de dispositivo v\u00e1lidas, pero no necesita privilegios de administrador. Estas vulnerabilidades se deben a una validaci\u00f3n insuficiente de la entrada proporcionada por el usuario para ciertas opciones de configuraci\u00f3n. Un atacante podr\u00eda aprovechar estas vulnerabilidades utilizando entradas manipuladas dentro de la GUI de configuraci\u00f3n del dispositivo. Un exploit exitoso podr\u00eda permitir al atacante ejecutar comandos arbitrarios en el dispositivo, incluido el sistema operativo subyacente, lo que tambi\u00e9n podr\u00eda afectar la disponibilidad del dispositivo."}], "lastModified": "2024-11-26T16:09:02.407", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B2802CF-8A7F-4FC6-A406-F1F26C932F3C", "versionEndIncluding": "6.2.3.18", "versionStartIncluding": "6.2.3"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6A2C229-3396-4411-9D39-49F53F6532CF", "versionEndIncluding": "6.4.0.16", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4500BF5-6E53-474F-A266-DFEA18880600", "versionEndIncluding": "6.6.7.1", "versionStartIncluding": "6.6.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C8ECB61-27AB-49B9-8201-AD36C3E924B0", "versionEndIncluding": "6.7.0.3", "versionStartIncluding": "6.7.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1D1E01B-8280-4011-8264-9D002C524CA1", "versionEndIncluding": "7.0.5", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75555C00-0F74-4A39-9F26-D38824D2323D", "versionEndIncluding": "7.1.0.3", "versionStartIncluding": "7.1.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7286D57-DA7E-4EA7-99C4-BB5A7C4DE76F", "versionEndIncluding": "7.2.3.1", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:a:cisco:secure_firewall_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFDB4F91-CD9E-409C-816E-B634C058FA7E", "versionEndIncluding": "7.3.1.1", "versionStartIncluding": "7.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}