CVE-2023-20261
Description
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco catalyst_sd-wan_manager | 17.2.4, 17.2.5, 17.2.6, 17.2.7, 17.2.8, 17.2.9, 17.2.10, 18.2.0, 18.3.0, 18.3.1, 18.3.1.1, 18.3.3, 18.3.3.1, 18.3.4, 18.3.5, 18.3.6.1, 18.3.7, 18.3.8, 18.4.0, 18.4.0.1, 18.4.1, 18.4.3, 18.4.4, 18.4.5, 18.4.6, 18.4.302, 18.4.303, 19.1.0, 19.2.0, 19.2.1, 19.2.2, 19.2.3, 19.2.4, 19.2.31, 19.2.097, 19.2.099, 19.2.929, 19.3.0, 20.1.1, 20.1.1.1, 20.1.2, 20.1.3, 20.1.12, 20.3.1, 20.3.2, 20.3.2.1, 20.3.3, 20.3.3.1, 20.3.4, 20.3.4.1, 20.3.4.2, 20.3.4.3, 20.3.5, 20.3.5.1, 20.3.6, 20.3.7, 20.3.7.1, 20.3.7.2, 20.3.8, 20.4.1, 20.4.1.1, 20.4.1.2, 20.4.2, 20.4.2.1, 20.4.2.2, 20.4.2.3, 20.5.1, 20.5.1.1, 20.5.1.2, 20.6.1, 20.6.1.1, 20.6.1.2, 20.6.2, 20.6.2.1, 20.6.2.2, 20.6.3, 20.6.3.0.45, 20.6.3.0.46, 20.6.3.0.47, 20.6.3.1, 20.6.3.2, 20.6.3.3, 20.6.3.4, 20.6.4, 20.6.4.0.21, 20.6.4.1, 20.6.4.2, 20.6.5, 20.6.5.1, 20.6.5.1.7, 20.6.5.1.9, 20.6.5.1.10, 20.6.5.1.11, 20.6.5.1.13, 20.6.5.2, 20.6.5.2.4, 20.6.5.2.8, 20.6.5.4, 20.6.5.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.