sec.cloudapps.cisco.com
Open in
urlscan Pro
72.163.15.141
Public Scan
URL:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv
Submission: On January 10 via api from TR — Scanned from DE
Submission: On January 10 via api from TR — Scanned from DE
Form analysis 1 forms found in the DOM
Name: pdfGeneration — POST /security/center/downloadPDF.pdf
<form action="/security/center/downloadPDF.pdf" "="" name=" pdfGeneration" method="post">
<input type="hidden" id="subpageId" value="cisco-sa-thouseyes-privesc-DmzHG3Qv" name="tyID">
<input type="hidden" value="CiscoSecurityAdvisory" name="typeName">
<input type="hidden" value="Cisco Security Advisory" name="documentType">
<input type="hidden" value="Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation Vulnerability" name="documentTitle">
<input type="hidden" id="pageId" value="AdvisoryContent">
<input type="hidden" id="userId" value="">
<input type="hidden" id="userFirstName" value="">
<input type="hidden" id="userLastName" value="">
<input type="hidden" id="appURL" value="https://sec.cloudapps.cisco.com/security/center/">
</form>Text Content
Home / Cisco Security / Security Advisories
CISCO SECURITY ADVISORY
CISCO THOUSANDEYES ENTERPRISE AGENT VIRTUAL APPLIANCE PRIVILEGE ESCALATION
VULNERABILITY
Medium
Advisory ID:
cisco-sa-thouseyes-privesc-DmzHG3Qv
First Published:
2024 January 10 16:00 GMT
Version 1.0:
Final
Workarounds:
No workarounds available
Cisco Bug IDs:
CSCwi14201
CVE-2024-20277
CVSS Score:
Base 6.8Click Icon to Copy Verbose Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
CVE-2024-20277
Download CSAF
Download CVRF
Email
SUMMARY
* A vulnerability in the web-based management interface of Cisco ThousandEyes
Enterprise Agent, Virtual Appliance installation type, could allow an
authenticated, remote attacker to perform a command injection and elevate
privileges to root.
This vulnerability is due to insufficient validation of user-supplied input
for the web interface. An attacker could exploit this vulnerability by
sending a crafted HTTP packet to the affected device. A successful exploit
could allow the attacker to execute arbitrary commands and elevate privileges
to root.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv
AFFECTED PRODUCTS
* VULNERABLE PRODUCTS
At the time of publication, this vulnerability affected the Virtual Appliance
installation of Cisco ThousandEyes Enterprise Agent.
For information about which Cisco software releases were vulnerable at the
time of publication, see the Fixed Software section of this advisory. See the
Details section in the bug ID(s) at the top of this advisory for the most
complete and current information.
PRODUCTS CONFIRMED NOT VULNERABLE
Only products listed in the Vulnerable Products section of this advisory are
known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following
Cisco products:
* ThousandEyes Docker Image installation type
* ThousandEyes Enterprise Agents on Cisco Routers with Docker
* ThousandEyes Linux Package installation type
WORKAROUNDS
* There are no workarounds that address this vulnerability.
FIXED SOFTWARE
* When considering software upgrades, customers are advised to regularly
consult the advisories for Cisco products, which are available from the Cisco
Security Advisories page, to determine exposure and a complete upgrade
solution.
In all cases, customers should ensure that the devices to be upgraded contain
sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance providers.
FIXED RELEASES
At the time of publication, the release information in the following table(s)
was accurate. See the Details section in the bug ID(s) at the top of this
advisory for the most complete and current information.
The left column lists Cisco software releases, and the right column indicates
whether a release was affected by the vulnerability that is described in this
advisory and which release included the fix for this vulnerability.
Cisco ThousandEyes Enterprise Agent Release First Fixed Release 0.233 and
earlier 0.233.2
Cisco ThousandEyes Enterprise virtual appliances run an Ubuntu Linux server
and have the unattended upgrades package installed by default, ensuring that
all critical security fixes are automatically installed. Unattended upgrades
require access to the internet and to the Ubuntu repositories.
The Cisco Product Security Incident Response Team (PSIRT) validates only the
affected and fixed release information that is documented in this advisory.
EXPLOITATION AND PUBLIC ANNOUNCEMENTS
* The Cisco PSIRT is not aware of any public announcements or malicious use of
the vulnerability that is described in this advisory.
SOURCE
* This vulnerability was found during the resolution of a Cisco TAC support
case.
CISCO SECURITY VULNERABILITY POLICY
* To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy. This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
SUBSCRIBE TO CISCO SECURITY NOTIFICATIONS
* Subscribe
RELATED TO THIS ADVISORY
*
URL
* https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv
REVISION HISTORY
* Version Description Section Status Date 1.0 Initial public release. - Final
2024-JAN-10
Show Less
--------------------------------------------------------------------------------
LEGAL DISCLAIMER
* THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR
MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE
RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the
distribution URL is an uncontrolled copy and may lack important information
or contain factual errors. The information in this document is intended for
end users of Cisco products.
FEEDBACK
*
Leave additional feedback
CISCO SECURITY VULNERABILITY POLICY
* To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy. This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
SUBSCRIBE TO CISCO SECURITY NOTIFICATIONS
* Subscribe
RELATED TO THIS ADVISORY
*
YOUR RATING:
YOUR RATING:
PLEASE LOG IN TO RATE
Log In Cancel
Average Rating:
5 star
4 star
3 star
2 star
1 star
Leave additional feedback
Cookies allow us to optimise your use of our website. We also use third-party
cookies for advertising and analytics. Please read our Privacy Statement and
Cookie Notice for more information.
Manage cookie settings Reject Accept
CONSENT MANAGER
* YOUR PRIVACY
* STRICTLY NECESSARY COOKIES
* PERFORMANCE COOKIES
* TARGETING COOKIES
* FUNCTIONAL COOKIES
YOUR PRIVACY
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer. Privacy Statement
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then
some or all of these services may not function properly.
Back Button
COOKIE LIST
Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
Clear
checkbox label label
Apply Cancel
Save Settings
Allow All
Feedback