Auth bypass in Arista Cloudvision Portal

CVE-2023-24546

On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.

EPSS: 0.005 (39.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

  • Arista Cloudvision_portal — versions 2022.1.0, 2022.1.1, 2022.2.0
  • N/a Cloudvision — versions <2021.1.0, <2021.2.0, <2021.3.0,

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-24546?
CVE-2023-24546 is a high-severity vulnerability in Arista Cloudvision Portal, classified under Improper Access Control. CVSS score: 8.1/10. Published 2023-06-13.
How severe is CVE-2023-24546?
High severity. CVSS v3 base score is 8.1 out of 10.