CVE-2023-20261

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files from an affected system. This vulnerability is due to improper validation of parameters that are sent to the web UI. An attacker could exploit this vulnerability by logging in to Cisco Catalyst SD-WAN Manager and issuing crafted requests using the web UI. A successful exploit could allow the attacker to obtain arbitrary files from the underlying Linux file system of an affected system. To exploit this vulnerability, the attacker must be an authenticated user.

• CWE-284

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-lfi-OWLbKUGeVendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-lfi-OWLbKUGeVendor Advisory

Published

Oct 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20256Multiple vulnerabilities in the per-user-override feature of…5.8
• CVE-2023-20257A vulnerability in the web-based management interface of Cis…4.8
• CVE-2023-20258A vulnerability in the web-based management interface of Cis…7.2
• CVE-2023-20259A vulnerability in an API endpoint of multiple Cisco Unified…7.5
• CVE-2023-2026The Image Protector WordPress plugin through 1.1 does not pr…4.8
• CVE-2023-20260A vulnerability in the application CLI of Cisco Prime Infras…6.7
• CVE-2023-20262A vulnerability in the SSH service of Cisco Catalyst SD-WAN …7.5
• CVE-2023-20263A vulnerability in the web-based management interface of Cis…6.1
• CVE-2023-20264A vulnerability in the implementation of Security Assertion …6.1
• CVE-2023-20265A vulnerability in the web-based management interface of a s…5.4
• CVE-2023-20266A vulnerability in Cisco Emergency Responder, Cisco Unified …7.2
• CVE-2023-20267A vulnerability in the IP geolocation rules of Snort 3 could…5.3