CVE-2022-20747 Cisco SD-WAN vManage Software Information Disclosure Vulnerability

Medium 6.5 Published 15 Apr 2022 Updated 6 Nov 2024

An authenticated attacker can access sensitive information via the History API due to insufficient authorization checks in Cisco SD-WAN vManage.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20747?

CVE-2022-20747 is a medium-severity missing authorization vulnerability in Cisco Catalyst Sd-Wan Manager, published on 15 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access.

Weakness: CWE-202

Which versions are affected by CVE-2022-20747?

It affects 2 products.

Products include Cisco Catalyst Sd-Wan Manager, Cisco Sd-Wan Vmanage.

How do I fix CVE-2022-20747?

No fix has been published for CVE-2022-20747 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-20747 being exploited?

There is no known exploitation of CVE-2022-20747 in the wild and no public exploit code.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-82gm-q2vc-g3x3.