CVE-2023-20254

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow an authenticated, remote attacker to access another tenant that is being managed by the same Cisco Catalyst SD-WAN Manager instance. This vulnerability requires the multi-tenant feature to be enabled. This vulnerability is due to insufficient user session management within the Cisco Catalyst SD-WAN Manager system. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to gain unauthorized access to information about another tenant, make configuration changes, or possibly take a tenant offline causing a denial of service condition.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Sep 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-202555.3A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a deniaCVE-2023-202565.8Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefCVE-2023-202574.8A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conductCVE-2023-202587.2A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to executeCVE-2023-202597.5A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to causCVE-2023-20264.8The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to CVE-2023-202606.7A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticCVE-2023-202616.5A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files froCVE-2023-202627.5A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to cause a process crashCVE-2023-202636.1A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker toCVE-2023-202646.1A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco ACVE-2023-202655.4A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to
CVE-2023-20254: High severity, CVSS 8.8 | Vulnix