CVE-2023-20238
First published: Wed Sep 06 2023(Updated: )
A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco BroadWorks Application Delivery Platform | =ri.2023.06 | |
| Cisco BroadWorks Application Delivery Platform | =ri.2023.07 | |
| Cisco BroadWorks Xtended Services Platform | <23.0.1075.ap384245 | |
| Cisco BroadWorks Xtended Services Platform | =2023.06 | |
| Cisco BroadWorks Xtended Services Platform | =2023.07 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-20238?
CVE-2023-20238 is a vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform.
How severe is CVE-2023-20238?
CVE-2023-20238 has a severity rating of 9.8, which is considered critical.
What can an attacker do with CVE-2023-20238?
An unauthenticated, remote attacker could exploit this vulnerability to forge credentials and gain unauthorized access to an affected system.
Which systems are affected by CVE-2023-20238?
Cisco BroadWorks Application Delivery Platform versions ri.2023.06 and ri.2023.07, as well as Cisco BroadWorks Xtended Services Platform versions up to 23.0.1075.ap384245, 2023.06, and 2023.07 are affected.
How can I fix CVE-2023-20238?
To fix CVE-2023-20238, it is recommended to apply the necessary patches or updates provided by Cisco.
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco broadworks application delivery platform
- version/cisco broadworks application delivery platform/ri.2023.06
- version/cisco broadworks application delivery platform/ri.2023.07
- canonical/cisco broadworks xtended services platform
- version/cisco broadworks xtended services platform/2023.06
- version/cisco broadworks xtended services platform/2023.07