CVE-2023-20113
Assigner: cisco
Published: 2023-03-23T00:00:00
State: PUBLISHED
title: Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability
datePublic: 2023-03-22T00:00:00
descriptions: value: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. These actions could include modifying the system configuration and deleting accounts.
affected: vendor: Cisco
product: Cisco SD-WAN vManage 
versions: version: n/a
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-352
cweId: CWE-352
source: advisory: cisco-sa-vman-csrf-76RDbLEh
defect: CSCwa83035
discovery: INTERNAL
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.