CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-20217 – Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read
https://notcve.org/view.php?id=CVE-2023-20217
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing certain commands using sudo. A successful exploit could allow the attacker to view arbitrary files as root on the underlying operating system. The attacker must have valid credentials on the affected device. Cisco ThousandEyes Enterprise Agent Virtual Appliance version thousandeyes-va-64-18.04 0.218 has an insecure sudo configuration which permits a low-privilege user to read root-only files via the dig command without a password. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-va-priv-esc-PUdgrx8E • CWE-250: Execution with Unnecessary Privileges •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-1537 – Cisco ThousandEyes Recorder Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-1537
A vulnerability in the installer software of Cisco ThousandEyes Recorder could allow an unauthenticated, local attacker to access sensitive information that is contained in the ThousandEyes Recorder installer software. This vulnerability exists because sensitive information is included in the application installer. An attacker could exploit this vulnerability by downloading the installer and extracting its contents. A successful exploit could allow the attacker to access sensitive information that is included in the application installer. Una vulnerabilidad en el software de instalación de Cisco ThousandEyes Recorder, podría permitir a un atacante local no autenticado acceder a información confidencial contenida en el software de instalación de ThousandEyes Recorder. • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-recorder-infodis-mx3ETTBM • CWE-522: Insufficiently Protected Credentials •