CVE-2023-24546

On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arista:cloudvision_portal::::::::
	cpe:2.3:a:arista:cloudvision_portal:2022.1.0:::::::*
	cpe:2.3:a:arista:cloudvision_portal:2022.1.1:::::::*
	cpe:2.3:a:arista:cloudvision_portal:2022.2.0:::::::*
	cpe:2.3:a:arista:cloudvision_portal:2022.2.1:::::::*
	cpe:2.3:a:arista:cloudvision_portal:2022.3.0:::::::*

History

No history.

Information

Published : 2023-06-13 21:15

Updated : 2023-11-07 04:08

NVD link : CVE-2023-24546

Mitre link : CVE-2023-24546

CVE.ORG link : CVE-2023-24546

JSON object : View

Products Affected

arista

cloudvision_portal

CWE

CWE-863

Incorrect Authorization

CWE-284

Improper Access Control

{"id": "CVE-2023-24546", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-06-13T21:15:09.867", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083", "tags": ["Vendor Advisory"], "source": "psirt@arista.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service."}], "lastModified": "2023-11-07T04:08:32.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8E8D1BB-B7ED-4886-96A0-FD0C9EA666CC", "versionEndIncluding": "2021.3", "versionStartIncluding": "2021.1"}, {"criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F429F0B9-A090-434C-8576-182CC021B76A"}, {"criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB325C9E-8116-434D-9865-DE494EC05F27"}, {"criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF2BF57D-7677-4531-80F8-15842798FBA2"}, {"criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08760308-AB42-496A-B473-98DAF7E4EDE1"}, {"criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF6936F8-946B-4A33-B1AD-76F0EFB65223"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@arista.com"}