CVE-2023-20017
Assigner: cisco
Published: 2023-08-16T21:01:28.215Z
State: PUBLISHED
descriptions: value: Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities.
 These vulnerabilities are due to insufficient input validation when extracting uploaded software packages. An attacker could exploit these vulnerabilities by authenticating to an affected device and uploading a crafted software package. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
affected: vendor: Cisco
product: Cisco Intersight Virtual Appliance
versions: version: 1.0.9-113
status: affected
version: 1.0.9-148
status: affected
version: 1.0.9-230
status: affected
version: 1.0.9-53
status: affected
version: 1.0.9-7
status: affected
version: 1.0.9-197
status: affected
version: 1.0.9-170
status: affected
version: 1.0.9-149
status: affected
version: 1.0.9-278
status: affected
version: 1.0.9-184
status: affected
version: 1.0.9-232
status: affected
version: 1.0.9-83
status: affected
version: 1.0.9-90
status: affected
version: 1.0.9-97
status: affected
version: 1.0.9-125
status: affected
version: 1.0.9-250
status: affected
version: 1.0.9-77
status: affected
version: 1.0.9-133
status: affected
version: 1.0.9-67
status: affected
version: 1.0.9-214
status: affected
version: 1.0.9-103
status: affected
version: 1.0.9-266
status: affected
version: 1.0.9-13
status: affected
version: 1.0.9-164
status: affected
version: 1.0.9-292
status: affected
version: 1.0.9-302
status: affected
version: 1.0.9-319
status: affected
version: 1.0.9-343
status: affected
version: 1.0.9-360
status: affected
version: 1.0.9-361
status: affected
version: 1.0.9-378
status: affected
version: 1.0.9-389
status: affected
version: 1.0.9-402
status: affected
version: 1.0.9-428
status: affected
version: 1.0.9-442
status: affected
version: 1.0.9-456
status: affected
problemTypes: descriptions: description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: cwe
cweId: CWE-78
metrics: format: cvssV3_1
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
baseScore: 6.5
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of these vulnerabilities that are described in this advisory.
source: advisory: cisco-sa-ivpa-cmdinj-C5XRbbOy
discovery: INTERNAL
defects: CSCwc35166