Riskcovery

CVE-2023-20207

State
Published
Severity
4.9 Medium
Published
Jul 12, 2023
Updated
Aug 2, 2024
Reserved
Oct 27, 2022

Read the record on cve.org

Description

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this vulnerability by accessing the logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to view sensitive information in clear text.

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Ncisco

Weaknesses

  • CWE-532 Insertion of Sensitive Information into Log File

Affected Products

ProductVersions
Cisco Duo Authentication ProxyCisco
  • 2.10.0Affected
  • 2.10.1Affected
  • 2.11.0Affected
  • 2.12.0Affected
  • 2.12.1Affected
  • 2.13.0Affected
  • 2.14.0Affected
  • 2.4.10Affected
  • 2.4.11Affected
  • 2.4.12Affected
  • 2.4.13Affected
  • 2.4.14Affected
  • 2.4.14.1Affected
  • 2.4.15Affected
  • 2.4.16Affected
  • 2.4.17Affected
  • 2.4.18Affected
  • 2.4.19Affected
  • 2.4.2Affected
  • 2.4.20Affected
  • 2.4.21Affected
  • 2.4.3Affected
  • 2.4.4Affected
  • 2.4.5Affected
  • 2.4.6Affected
  • and 35 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.