Sign-up

ID

VAR-202208-1879


CVE

CVE-2022-20921


TITLE

Cisco Systems  Cisco ACI Multi-Site Orchestrator  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-017325

DESCRIPTION

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sending crafted HTTP requests. A successful exploit could allow an attacker who is authenticated with non-Administrator privileges to elevate to Administrator privileges on an affected device. Cisco Systems Cisco ACI Multi-Site Orchestrator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco ACI Multi-Site Orchestrator is a multi-site orchestrator of Cisco (Cisco). Provide consistent network and policy orchestration, scalability, and disaster recovery across multiple data centers through a single pane of glass while allowing data centers to go wherever data resides. Attackers exploit this vulnerability to escalate system privileges

Trust: 1.71

sources: NVD: CVE-2022-20921 // JVNDB: JVNDB-2022-017325 // VULHUB: VHN-405474

AFFECTED PRODUCTS

vendor:ciscomodel:aci multi-site orchestratorscope:ltversion:3.1\(1n\)

Trust: 1.0

vendor:シスコシステムズmodel:cisco aci multi-site orchestratorscope:eqversion:3.1(1n)

Trust: 0.8

vendor:シスコシステムズmodel:cisco aci multi-site orchestratorscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-017325 // NVD: CVE-2022-20921

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-20921
value: HIGH

Trust: 1.8

ykramarz@cisco.com: CVE-2022-20921
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202208-3837
value: HIGH

Trust: 0.6

NVD:
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-20921
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-017325 // NVD: CVE-2022-20921 // NVD: CVE-2022-20921 // CNNVD: CNNVD-202208-3837

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-017325 // NVD: CVE-2022-20921

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-3837

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202208-3837

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-20921

PATCH
title:cisco-sa-mso-prvesc-BPFp9cZsurl:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-mso-prvesc-bpfp9czs
Trust: 0.8
title:Cisco ACI Multi-Site Orchestrator Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=206053
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2022-017325 // 
            
            
            
            CNNVD: CNNVD-202208-3837

EXTERNAL IDS
db:NVDid:CVE-2022-20921
Trust: 3.3
db:JVNDBid:JVNDB-2022-017325
Trust: 0.8
db:CNNVDid:CNNVD-202208-3837
Trust: 0.7
db:AUSCERTid:ESB-2022.4194
Trust: 0.6
db:VULHUBid:VHN-405474
Trust: 0.1
sources:
            
            
            VULHUB: VHN-405474 // 
            
            
            
            JVNDB: JVNDB-2022-017325 // 
            
            
            
            NVD: CVE-2022-20921 // 
            
            
            
            CNNVD: CNNVD-202208-3837

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-mso-prvesc-bpfp9czs
Trust: 2.3
url:https://nvd.nist.gov/vuln/detail/cve-2022-20921
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2022.4194
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-20921/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-405474 // 
            
            
            
            JVNDB: JVNDB-2022-017325 // 
            
            
            
            NVD: CVE-2022-20921 // 
            
            
            
            CNNVD: CNNVD-202208-3837

SOURCES
db:VULHUBid:VHN-405474
db:JVNDBid:JVNDB-2022-017325
db:NVDid:CVE-2022-20921
db:CNNVDid:CNNVD-202208-3837

LAST UPDATE DATE
2023-12-18T14:03:49.246000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-405474date:2022-08-29T00:00:00
db:JVNDBid:JVNDB-2022-017325date:2023-10-12T07:30:00
db:NVDid:CVE-2022-20921date:2023-11-07T03:43:19.910
db:CNNVDid:CNNVD-202208-3837date:2022-08-30T00:00:00

SOURCES RELEASE DATE
db:VULHUBid:VHN-405474date:2022-08-25T00:00:00
db:JVNDBid:JVNDB-2022-017325date:2023-10-12T00:00:00
db:NVDid:CVE-2022-20921date:2022-08-25T19:15:08.327
db:CNNVDid:CNNVD-202208-3837date:2022-08-24T00:00:00