CVE-2023-20217
Medium
Description
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing certain commands using sudo. A successful exploit could allow the attacker to view arbitrary files as root on the underlying operating system. The attacker must have valid credentials on the affected device.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Cisco Thousandeyes Enterprise Agent
PublishedAug 16, 2023
First seenAug 16, 2023
Weakness typeCWE-250CWE-250
How to fix
Update
- cisco thousandeyes_enterprise_agent0.230 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco thousandeyes_enterprise_agent | v < 0.230 | 0.230 |
| cisco thousandeyes_recorder | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.