CVEvulnerability

CVE-2023-20098

6.0 MEDIUM Published 2023-05-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-05-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
6.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-22, CWE-24

Description

A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could exploit this vulnerability by running a system command containing directory traversal character sequences to target an arbitrary file. A successful exploit could allow the attacker to delete arbitrary files from the system, including files owned by root.

Affected configurations

• cisco catalyst sd-wan manager 20.11 • cisco sd-wan vmanage (< 20.9.1)

Related

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-24 Path Traversal: '../filedir' weakness

References