CVE-2023-20155
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
21.3%
A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to become unresponsive or trigger an unexpected reload. This vulnerability could also allow an attacker with valid user credentials, but not Administrator privileges, to view a system log file that they would not normally have access to. This vulnerability is due to a lack of rate-limiting of requests that are sent to a specific API that is related to an FMC log. An attacker could exploit this vulnerability by sending a high rate of HTTP requests to the API. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the FMC CPU spiking to 100 percent utilization or to the device reloading. CPU utilization would return to normal if the attack traffic was stopped before an unexpected reload was triggered.
Affected configurations
CNA Affected
[
{
"vendor": "Cisco",
"product": "Cisco Firepower Management Center",
"versions": [
{
"version": "6.2.3",
"status": "affected"
},
{
"version": "6.2.3.1",
"status": "affected"
},
{
"version": "6.2.3.2",
"status": "affected"
},
{
"version": "6.2.3.3",
"status": "affected"
},
{
"version": "6.2.3.4",
"status": "affected"
},
{
"version": "6.2.3.5",
"status": "affected"
},
{
"version": "6.2.3.6",
"status": "affected"
},
{
"version": "6.2.3.7",
"status": "affected"
},
{
"version": "6.2.3.9",
"status": "affected"
},
{
"version": "6.2.3.10",
"status": "affected"
},
{
"version": "6.2.3.11",
"status": "affected"
},
{
"version": "6.2.3.12",
"status": "affected"
},
{
"version": "6.2.3.13",
"status": "affected"
},
{
"version": "6.2.3.14",
"status": "affected"
},
{
"version": "6.2.3.15",
"status": "affected"
},
{
"version": "6.2.3.8",
"status": "affected"
},
{
"version": "6.2.3.16",
"status": "affected"
},
{
"version": "6.2.3.17",
"status": "affected"
},
{
"version": "6.2.3.18",
"status": "affected"
},
{
"version": "6.4.0",
"status": "affected"
},
{
"version": "6.4.0.1",
"status": "affected"
},
{
"version": "6.4.0.3",
"status": "affected"
},
{
"version": "6.4.0.2",
"status": "affected"
},
{
"version": "6.4.0.4",
"status": "affected"
},
{
"version": "6.4.0.5",
"status": "affected"
},
{
"version": "6.4.0.6",
"status": "affected"
},
{
"version": "6.4.0.7",
"status": "affected"
},
{
"version": "6.4.0.8",
"status": "affected"
},
{
"version": "6.4.0.9",
"status": "affected"
},
{
"version": "6.4.0.10",
"status": "affected"
},
{
"version": "6.4.0.11",
"status": "affected"
},
{
"version": "6.4.0.12",
"status": "affected"
},
{
"version": "6.4.0.13",
"status": "affected"
},
{
"version": "6.4.0.14",
"status": "affected"
},
{
"version": "6.4.0.15",
"status": "affected"
},
{
"version": "6.4.0.16",
"status": "affected"
},
{
"version": "6.6.0",
"status": "affected"
},
{
"version": "6.6.0.1",
"status": "affected"
},
{
"version": "6.6.1",
"status": "affected"
},
{
"version": "6.6.3",
"status": "affected"
},
{
"version": "6.6.4",
"status": "affected"
},
{
"version": "6.6.5",
"status": "affected"
},
{
"version": "6.6.5.1",
"status": "affected"
},
{
"version": "6.6.5.2",
"status": "affected"
},
{
"version": "6.6.7",
"status": "affected"
},
{
"version": "6.6.7.1",
"status": "affected"
},
{
"version": "6.7.0",
"status": "affected"
},
{
"version": "6.7.0.1",
"status": "affected"
},
{
"version": "6.7.0.2",
"status": "affected"
},
{
"version": "6.7.0.3",
"status": "affected"
},
{
"version": "7.0.0",
"status": "affected"
},
{
"version": "7.0.0.1",
"status": "affected"
},
{
"version": "7.0.1",
"status": "affected"
},
{
"version": "7.0.1.1",
"status": "affected"
},
{
"version": "7.0.2",
"status": "affected"
},
{
"version": "7.0.2.1",
"status": "affected"
},
{
"version": "7.0.3",
"status": "affected"
},
{
"version": "7.0.4",
"status": "affected"
},
{
"version": "7.0.5",
"status": "affected"
},
{
"version": "7.1.0",
"status": "affected"
},
{
"version": "7.1.0.1",
"status": "affected"
},
{
"version": "7.1.0.2",
"status": "affected"
},
{
"version": "7.1.0.3",
"status": "affected"
},
{
"version": "7.2.0",
"status": "affected"
},
{
"version": "7.2.1",
"status": "affected"
},
{
"version": "7.2.2",
"status": "affected"
},
{
"version": "7.2.0.1",
"status": "affected"
},
{
"version": "7.2.3",
"status": "affected"
},
{
"version": "7.2.3.1",
"status": "affected"
},
{
"version": "7.3.0",
"status": "affected"
},
{
"version": "7.3.1",
"status": "affected"
},
{
"version": "7.3.1.1",
"status": "affected"
}
]
}
]Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
21.3%