FKIE_CVE-2023-20238

Vulnerability from fkie_nvd - Published: 2023-09-06 18:15 - Updated: 2024-11-21 07:40
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system.
References
psirt@cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-auth-bypass-kCggMWhXVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-auth-bypass-kCggMWhXVendor Advisory
Impacted products
Vendor Product Version
cisco broadworks_application_delivery_platform ri.2023.06
cisco broadworks_application_delivery_platform ri.2023.07
cisco broadworks_xtended_services_platform *
cisco broadworks_xtended_services_platform 2023.06
cisco broadworks_xtended_services_platform 2023.07
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:broadworks_application_delivery_platform:ri.2023.06:*:*:*:*:*:*:*",
              "matchCriteriaId": "95D3C201-88EC-44F7-8ED2-6CFD726FAC73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:broadworks_application_delivery_platform:ri.2023.07:*:*:*:*:*:*:*",
              "matchCriteriaId": "94C37251-4CAB-499E-AFD0-4AAD78288A51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:broadworks_xtended_services_platform:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "3DA39D01-BCC5-4B5E-A146-5CAEA4F9ED70",
              "versionEndExcluding": "23.0.1075.ap384245",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:broadworks_xtended_services_platform:2023.06:*:*:*:release_independent:*:*:*",
              "matchCriteriaId": "FAA6AF4C-2CBF-4F59-B5DE-809CFE82DD6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:broadworks_xtended_services_platform:2023.07:*:*:*:release_independent:*:*:*",
              "matchCriteriaId": "07A9E1FF-7458-4035-AF12-056585F7DC6D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system.\r\n\r This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la implementaci\u00f3n del inicio de sesi\u00f3n \u00fanico (SSO) de Cisco BroadWorks Application Delivery Platform y Cisco BroadWorks Xtended Services Platform podr\u00eda permitir que un atacante remoto no autenticado falsifique las credenciales necesarias para acceder a un sistema afectado. Esta vulnerabilidad se debe al m\u00e9todo utilizado para validar los tokens de SSO. Un atacante podr\u00eda aprovechar esta vulnerabilidad autentic\u00e1ndose en la aplicaci\u00f3n con credenciales falsificadas. Un exploit exitoso podr\u00eda permitir al atacante cometer fraude telef\u00f3nico o ejecutar comandos en el nivel de privilegio de la cuenta falsificada. Si esa cuenta es una cuenta de administrador, el atacante tendr\u00eda la capacidad de ver informaci\u00f3n confidencial, modificar la configuraci\u00f3n del cliente o modificar la configuraci\u00f3n de otros usuarios. Para aprovechar esta vulnerabilidad, el atacante necesitar\u00eda una identificaci\u00f3n de usuario v\u00e1lida asociada con un sistema Cisco BroadWorks afectado."
    }
  ],
  "id": "CVE-2023-20238",
  "lastModified": "2024-11-21T07:40:57.973",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-06T18:15:08.043",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-auth-bypass-kCggMWhX"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-auth-bypass-kCggMWhX"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.