What is CVE-2023-20207?

CVE-2023-20207 is a medium-severity vulnerability in Cisco Duo Authentication Proxy, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2023-07-12.

How severe is CVE-2023-20207?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Information disclosure in Cisco Duo Authentication Proxy

CVE-2023-20207

A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability exists because certain unencr…

EPSS: 0.004 (27.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Cisco Duo Authentication Proxy — versions 2.10.0, 2.10.1, 2.11.0
Duo Authentication_proxy — versions 5.8.1, 6.0.0

Weakness classification (CWE)

References

psirt@cisco.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-20207?: CVE-2023-20207 is a medium-severity vulnerability in Cisco Duo Authentication Proxy, classified under Insertion of Sensitive Information into Log File. CVSS score: 4.9/10. Published 2023-07-12.
How severe is CVE-2023-20207?: Medium severity. CVSS v3 base score is 4.9 out of 10.