Lucene search

K
ciscoCiscoCISCO-SA-VMAN-CSRF-76RDBLEH
HistoryMar 22, 2023 - 4:00 p.m.

Cisco SD-WAN vManage Software Cluster Mode Cross-Site Request Forgery Vulnerability

2023-03-2216:00:00
tools.cisco.com
20
cisco
sd-wan
vmanage
vulnerability
csrf
web-based management interface
cluster mode
remote attacker
security advisory
software updates

EPSS

0.001

Percentile

34.2%

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software when it is operating in cluster mode could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.

This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. These actions could include modifying the system configuration and deleting accounts.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-csrf-76RDbLEh [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-csrf-76RDbLEh”]

Affected configurations

Vulners
Node
ciscosd-wan_vmanage
VendorProductVersionCPE
ciscosd-wan_vmanage*cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*

EPSS

0.001

Percentile

34.2%

Related for CISCO-SA-VMAN-CSRF-76RDBLEH