CVE-2024-20503

Sept. 13, 2024, 7:24 p.m.

5.5
Medium

Description

A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This vulnerability is due to improper storage of an unencrypted registry key. A low-privileged attacker could exploit this vulnerability by viewing or querying the registry key on the affected system. A successful exploit could allow the attacker to view sensitive information in cleartext.

Product(s) Impacted

Vendor Product Versions
Cisco
  • Duo Authentication For Epic
  • 1.0.0, 1.0.1, 1.1.9, 1.1.10, 1.1.13, 1.2.0.95

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-311
Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a cisco duo_authentication_for_epic 1.0.0 / / / / / / /
a cisco duo_authentication_for_epic 1.0.1 / / / / / / /
a cisco duo_authentication_for_epic 1.1.9 / / / / / / /
a cisco duo_authentication_for_epic 1.1.10 / / / / / / /
a cisco duo_authentication_for_epic 1.1.13 / / / / / / /
a cisco duo_authentication_for_epic 1.2.0.95 / / / / / / /

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-epic-info-sdLv6h8y

Tags

CWE-200
ykramarz@cisco.com
CWE-311
2024-09-04
CVE-2024-20503

CVSS Score

5.5 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: Sept. 4, 2024, 5:15 p.m.
Last Modified: Sept. 13, 2024, 7:24 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

ykramarz@cisco.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.