CVE-2022-20747
Assigner: cisco
Published: 2022-04-13T00:00:00
State: PUBLISHED
affected: product: Cisco SD-WAN vManage 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2022-04-13T00:00:00
descriptions: value: A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access.
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-202
description: CWE-202
type: CWE
source: advisory: cisco-sa-sdwan-vman-infodis-73sHJNEq
defect: CSCvy67842
discovery: INTERNAL
title: Cisco SD-WAN vManage Software Information Disclosure Vulnerability