Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

CVE-2023-20235

Cisco Cisco IOS XE Software

MEDIUM 6.5

En bref

Source
NVD
EPSS
EPSS 0.86 % · centile 58 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Modified

Description

A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an authenticated, remote attacker to access the underlying operating system as the root user. This vulnerability exists because Docker containers with the privileged runtime option are not blocked when they are in application development mode. An attacker could exploit this vulnerability by using the Docker CLI to access an affected device. The application development workflow is meant to be used only on development systems and not in production systems.

Faiblesses (CWE)

  • CWE-552 — Fichiers ou répertoires accessibles à des tiers
  • CWE-269 — Gestion incorrecte des privilèges

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Ncisco
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NNVD · psirt@cisco.com (Secondary)
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco IOS XE Softwareaffected 17.3.1 ; affected 17.3.2 ; affected 17.3.3 ; affected 17.3.1a ; affected 17.3.1w ; affected 17.3.2a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD