cisco-sa-sdwan-vman-infodis-73sHJNEq: Cisco SD-WAN vManage Software Information Disclosure Vulnerability
First published: Wed Apr 13 2022(Updated: )
A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-infodis-73sHJNEq
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN | =20.7<20.7.1>=18.3 and earlier=18.4=19.2=20.1=20.3=20.4=20.5<=20.6<20.6.1 | 20.7.1 20.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco SD-WAN vManage Software vulnerability?
The vulnerability ID for this Cisco SD-WAN vManage Software vulnerability is cisco-sa-sdwan-vman-infodis-73sHJNEq.
What is the severity of the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability?
The severity of the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability is medium with a CVSS score of 6.5.
How does the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability work?
The cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability allows an authenticated, remote attacker to gain access to sensitive information on an affected system by exploiting insufficient API authorization checking on the underlying operating system.
Which versions of Cisco SD-WAN vManage Software are affected by the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability?
The versions affected by the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability are 18.3 and earlier, 18.4, 19.2, 20.1, 20.3, 20.4, 20.5, 20.6, 20.6.1, 20.7, and 20.7.1.
How can I fix the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability?
To fix the cisco-sa-sdwan-vman-infodis-73sHJNEq vulnerability, users should upgrade to Cisco SD-WAN vManage Software version 20.7.1 or 20.6.1, as these versions contain the necessary security patches.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/title
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco sd-wan
- version/cisco sd-wan/20.7
- version/cisco sd-wan/18.3 and earlier
- version/cisco sd-wan/18.4
- version/cisco sd-wan/19.2
- version/cisco sd-wan/20.1
- version/cisco sd-wan/20.3
- version/cisco sd-wan/20.4
- version/cisco sd-wan/20.5
- version/cisco sd-wan/20.6