CVE-2023-20088
CVSS V2 None
CVSS V3 None
Description
A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users who are connected through a load balancer. This vulnerability is due to improper IP address filtering by the reverse proxy. An attacker could exploit this vulnerability by sending a series of unauthenticated requests to the reverse proxy. A successful exploit could allow the attacker to cause all current traffic and subsequent requests to the reverse proxy through a load balancer to be dropped, resulting in a DoS condition.
Overview
- CVE ID
- CVE-2023-20088
- Assigner
- ykramarz@cisco.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-03-03T16:15:10
- Last Modified Date
- 2023-03-10T14:04:45
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:cisco:finesse:*:*:*:*:*:*:*:* | 1 | OR | 12.6\(1\) | |
| cpe:2.3:a:cisco:finesse:12.6\(1\):-:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:cisco:finesse:12.6\(1\):es01:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:cisco:finesse:12.6\(1\):es02:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:cisco:finesse:12.6\(1\):es03:*:*:*:*:*:* | 1 | OR |
References
| Reference URL | Reference Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-proxy-dos-vY5dQhrV | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-20088 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20088 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 05:54:04 | Added to TrackCVE | |||
| 2023-04-17 05:54:07 | Weakness Enumeration | new |