How severe is CVE-2023-20252?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2023-20252?

This is classified as CWE-862, which is a common weakness in software security.

CVE-2023-20252 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML APIs. An attacker could exploit this vulnerability by sending requests directly to the SAML API. A successful exploit could allow the attacker to generate an authorization token sufficient to gain access to the application.

Related Vulnerabilities

CVE-2011-4183

CRITICAL

CVSS:9.8(Critical)

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.

CWE-8622011

CVE-2016-11036

CRITICAL

CVSS:9.8(Critical)

An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (August 2016).

CWE-8622016

CVE-2017-1000056

CRITICAL

CVSS:9.8(Critical)

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CWE-8622017

CVE-2017-12582

CRITICAL

CVSS:9.8(Critical)

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that un...

CWE-8622017

CVE-2017-9232

CRITICAL

CVSS:9.8(Critical)

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

CWE-8622017

CVE-2018-10251

CRITICAL

CVSS:9.8(Critical)

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9.3 could all...

CWE-8622018