CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20123 – Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay Vulnerability
https://notcve.org/view.php?id=CVE-2023-20123
A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows device. This vulnerability exists because session credentials do not properly expire. An attacker could exploit this vulnerability by replaying previously used multifactor authentication (MFA) codes to bypass MFA protection. A successful exploit could allow the attacker to gain unauthorized access to the affected device. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-replay-knuNKd • CWE-294: Authentication Bypass by Capture-replay •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-20662 – Cisco Duo for macOS Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-20662
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user. Una vulnerabilidad en la autenticación de inicio de sesión con tarjeta inteligente de Cisco Duo para macOS podría permitir a un atacante no autenticado con acceso físico omitir la autenticación. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-macOS-bypass-uKZNpXE6 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3427 – Duo Authentication for Windows Logon and RDP Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-3427
The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can manipulate files used by Windows Logon, cause Denial of Service (DoS) by deleting file(s), or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue. • https://duo.com/docs/rdp-notes • CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-3483 – Duo Network Gateway (DNG) Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-3483
Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG host. Any private keys logged in this way could be viewed by those with access to the DNG host operating system without any need for reversing encrypted values or similar techniques. An attacker that gained access to the DNG logs and with the ability to intercept and manipulate network traffic between a user and the DNG, could decrypt and manipulate SSL/TLS connections to the DNG and to the protected applications behind it. Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7 are affected. • https://duo.com/labs/psa/duo-psa-2020-004 • CWE-256: Plaintext Storage of a Password CWE-522: Insufficiently Protected Credentials •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7340 – Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
https://notcve.org/view.php?id=CVE-2018-7340
Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. Duo Network Gateway versión 1.2.9 y anteriores pueden utilizar incorrectamente los resultados de las API de transversalidad y canonicalización de DOM de XML de tal manera que un atacante pueda manipular los datos SAML sin invalidar la firma criptográfica, lo que permite que el ataque omita la identificación a los proveedores de servicio de SAML. • https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations https://www.kb.cert.org/vuls/id/475445 • CWE-287: Improper Authentication CWE-347: Improper Verification of Cryptographic Signature •