CVE-2024-20315
Assigner: cisco
Published: 2024-03-13T16:45:58.046Z
State: PUBLISHED
descriptions: value: A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.
 This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL.
affected: vendor: Cisco
product: Cisco IOS XR Software
versions: version: 7.9.1
status: affected
version: 7.9.2
status: affected
version: 7.10.1
status: affected
problemTypes: descriptions: description: Improper Access Control
type: cwe
cweId: CWE-284
metrics: format: cvssV3_1
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
baseScore: 5.8
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
source: advisory: cisco-sa-iosxr-acl-bypass-RZU5NL3e
discovery: INTERNAL
defects: CSCwf99658