CVE-2023-20238
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system.
This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system.
Una vulnerabilidad en la implementación del inicio de sesión único (SSO) de Cisco BroadWorks Application Delivery Platform y Cisco BroadWorks Xtended Services Platform podría permitir que un atacante remoto no autenticado falsifique las credenciales necesarias para acceder a un sistema afectado. Esta vulnerabilidad se debe al método utilizado para validar los tokens de SSO. Un atacante podría aprovechar esta vulnerabilidad autenticándose en la aplicación con credenciales falsificadas. Un exploit exitoso podría permitir al atacante cometer fraude telefónico o ejecutar comandos en el nivel de privilegio de la cuenta falsificada. Si esa cuenta es una cuenta de administrador, el atacante tendría la capacidad de ver información confidencial, modificar la configuración del cliente o modificar la configuración de otros usuarios. Para aprovechar esta vulnerabilidad, el atacante necesitaría una identificación de usuario válida asociada con un sistema Cisco BroadWorks afectado.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2022-10-27 CVE Reserved
- 2023-09-06 CVE Published
- 2024-10-08 EPSS Updated
- 2024-10-23 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Broadworks Application Delivery Platform Search vendor "Cisco" for product "Broadworks Application Delivery Platform" | ri.2023.06 Search vendor "Cisco" for product "Broadworks Application Delivery Platform" and version "ri.2023.06" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Broadworks Application Delivery Platform Search vendor "Cisco" for product "Broadworks Application Delivery Platform" | ri.2023.07 Search vendor "Cisco" for product "Broadworks Application Delivery Platform" and version "ri.2023.07" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Broadworks Xtended Services Platform Search vendor "Cisco" for product "Broadworks Xtended Services Platform" | < 23.0.1075.ap384245 Search vendor "Cisco" for product "Broadworks Xtended Services Platform" and version " < 23.0.1075.ap384245" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Broadworks Xtended Services Platform Search vendor "Cisco" for product "Broadworks Xtended Services Platform" | 2023.06 Search vendor "Cisco" for product "Broadworks Xtended Services Platform" and version "2023.06" | release_independent |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Broadworks Xtended Services Platform Search vendor "Cisco" for product "Broadworks Xtended Services Platform" | 2023.07 Search vendor "Cisco" for product "Broadworks Xtended Services Platform" and version "2023.07" | release_independent |
Affected
| ||||||