CVE-2023-20238: A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWo

Description

A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account. If that account is an Administrator account, the attacker would have the ability to view confidential information, modify customer settings, or modify settings for other users. To exploit this vulnerability, the attacker would need a valid user ID that is associated with an affected Cisco BroadWorks system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco BroadWorks

23.0affected
23.0 ap383785affected
23.0 ap382487affected
23.0 ap381781affected
23.0 ap360007affected
23.0 ap369295affected
23.0 ap366358affected
23.0 ap366677affected
23.0 ap366803affected
23.0 ap363128affected
23.0 ap369529affected
23.0 ap368445affected
23.0 ap369227affected
23.0 ap367332affected
23.0 ap369881affected
23.0 ap367874affected
23.0 ap367974affected
23.0 ap367998affected
23.0 ap372337affected
23.0 ap372706affected
23.0 ap370193affected
23.0 ap372389affected
23.0 ap372708affected
23.0 ap370911affected
23.0 ap371681affected
23.0 ap370952affected
23.0 ap371436affected
23.0 ap371155affected
23.0 ap371682affected
23.0 ap371775affected
23.0 ap375449affected
23.0 ap375720affected
23.0 ap375661affected
23.0 ap375097affected
23.0 ap373562affected
23.0 ap373015affected
23.0 ap374971affected
23.0 ap373034affected
23.0 ap374324affected
23.0 ap373899affected
23.0 ap376041affected
23.0 ap375003affected
23.0 ap373539affected
23.0 ap376179affected
23.0 ap373299affected
23.0 ap375908affected
23.0 ap373391affected
23.0 ap376252affected
23.0 ap376429affected
23.0 ap376410affected
23.0 ap376426affected
23.0 ap376485affected
23.0 ap376620affected
23.0 ap378025affected
23.0 ap376671affected
23.0 ap376614affected
23.0 ap377578affected
23.0 ap377516affected
23.0 ap377515affected
23.0 ap377494affected
23.0 ap377984affected
23.0 ap378863affected
23.0 ap378882affected
23.0 ap378218affected
23.0 ap380161affected
23.0 ap378257affected
23.0 ap379888affected
23.0 ap379326affected
23.0 ap377149affected
23.0 ap380446affected
23.0 ap380180affected
23.0 ap376935affected
23.0 ap380473affected
23.0 ap381091affected
23.0 ap380783affected
23.0 ap380537affected
23.0 ap380512affected
23.0 ap381072affected
23.0 ap381584affected
23.0 ap381088affected
23.0 ap382053affected
23.0 ap382253affected
23.0 ap382709affected
23.0 ap382717affected
23.0 ap381498affected
23.0 ap382992affected
23.0 ap383594affected
23.0 ap383168affected
23.0 ap382362affected
23.0 ap384431affected
23.0 ap384428affected
22.0affected
22.0 ap375345affected
22.0 ap382358affected
22.0 ap347741affected
22.0 ap377577affected
22.0 ap372243affected
22.0 ap372504affected
22.0 ap360116affected
22.0 ap368125affected
22.0 ap367732affected
22.0 ap357506affected
22.0 ap380486affected
22.0 ap379780affected
22.0 ap351263affected
22.0 ap366916affected
22.0 ap363363affected
22.0 ap374507affected
22.0 ap372845affected
22.0 ap373684affected
22.0 ap366898affected
22.0 ap368180affected
22.0 ap366882affected
22.0 ap369774affected
22.0 ap374269affected
22.0 ap365223affected
22.0 ap359972affected
22.0 ap359433affected
22.0 ap359991affected
22.0 ap358357affected
22.0 ap360244affected
22.0 ap369931affected
22.0 ap367874affected
22.0 ap376710affected
22.0 ap342836affected
22.0 ap346307affected
22.0 ap345032affected
22.0 ap354070affected
22.0 ap354069affected
22.0 ap353915affected
22.0 ap349201affected
22.0 ap350217affected
22.0 ap350179affected
22.0 ap354313affected
22.0 ap354098affected
22.0 ap353975affected
22.0 ap348945affected
22.0 ap354090affected
22.0 ap350573affected
22.0 ap352516affected
22.0 ap352109affected
22.0 ap353384affected
22.0 ap353490affected
22.0 ap352962affected
22.0 ap352703affected
22.0 ap353418affected
22.0 ap351700affected
22.0 ap352205affected
22.0 ap353360affected
22.0 ap352932affected
22.0 ap354921affected
22.0 ap352726affected
22.0 ap355757affected
22.0 ap352972affected
22.0 ap353577affected
22.0 ap356603affected
22.0 ap355894affected
22.0 ap355385affected
22.0 ap353311affected
22.0 ap355300affected
22.0 ap355083affected
22.0 ap357047affected
22.0 ap353681affected
22.0 ap356848affected
22.0 ap356706affected
22.0 ap356474affected
22.0 ap355091affected
22.0 ap354785affected
22.0 ap355905affected
22.0 ap355365affected
22.0 ap356359affected
22.0 ap356434affected
22.0 ap354936affected
22.0 ap355285affected
22.0 ap355674affected
22.0 ap355922affected
22.0 ap354597affected
22.0 ap356458affected
22.0 ap356140affected
22.0 ap354413affected
22.0 ap357400affected
22.0 ap357632affected
22.0 ap356390affected
22.0 ap357607affected
22.0 ap357447affected
22.0 ap357560affected
22.0 ap357645affected
22.0 ap357768affected
22.0 ap357859affected
22.0 ap357769affected
22.0 ap358469affected
22.0 ap359049affected
22.0 ap358971affected
22.0 ap358246affected
22.0 ap358234affected
22.0 ap359156affected
22.0 ap359549affected
22.0 ap358454affected
22.0 ap358563affected
22.0 ap360250affected
22.0 ap360564affected
22.0 ap358887affected
22.0 ap359470affected
22.0 ap359465affected
22.0 ap359748affected
22.0 ap360817affected
22.0 ap360201affected
22.0 ap361153affected
22.0 ap360904affected
22.0 ap359644affected
22.0 ap359765affected
22.0 ap360912affected
22.0 ap360184affected
22.0 ap361520affected
22.0 ap362771affected
22.0 ap361445affected
22.0 ap361560affected
22.0 ap362848affected
22.0 ap361559affected
22.0 ap361820affected
22.0 ap361533affected
22.0 ap362163affected
22.0 ap362001affected
22.0 ap362276affected
22.0 ap362490affected
22.0 ap361154affected
22.0 ap362799affected
22.0 ap363815affected
22.0 ap362328affected
22.0 ap363332affected
22.0 ap368026affected
22.0 ap363521affected
22.0 ap364199affected
22.0 ap363568affected
22.0 ap363759affected
22.0 ap363596affected
22.0 ap366701affected
22.0 ap366174affected
22.0 ap363729affected
22.0 ap363770affected
22.0 ap366358affected
22.0 ap366744affected
22.0 ap366180affected
22.0 ap366649affected
22.0 ap365172affected
22.0 ap365115affected
22.0 ap366656affected
22.0 ap364521affected
22.0 ap364844affected
22.0 ap364781affected
22.0 ap365146affected
22.0 ap364797affected
22.0 ap364932affected
22.0 ap365545affected
22.0 ap365800affected
22.0 ap365173affected
22.0 ap364473affected
22.0 ap365400affected
22.0 ap367396affected
22.0 ap365632affected
22.0 ap365905affected
22.0 ap367109affected
22.0 ap365449affected
22.0 ap365685affected
22.0 ap367434affected
22.0 ap365597affected
22.0 ap365801affected
22.0 ap365730affected
22.0 ap365758affected
22.0 ap365920affected
22.0 ap371313affected
22.0 ap367291affected
22.0 ap365727affected
22.0 ap367524affected
22.0 ap371587affected
22.0 ap367453affected
22.0 ap365601affected
22.0 ap365779affected
22.0 ap371871affected
22.0 ap371437affected
22.0 ap372043affected
22.0 ap372016affected
22.0 ap367367affected
22.0 ap372072affected
22.0 ap372177affected
22.0 ap371681affected
22.0 ap372354affected
22.0 ap371656affected
22.0 ap371033affected
22.0 ap371583affected
22.0 ap371911affected
22.0 ap371467affected
22.0 ap372371affected
22.0 ap368695affected
22.0 ap368913affected
22.0 ap368987affected
22.0 ap372024affected
22.0 ap372152affected
22.0 ap371961affected
22.0 ap369674affected
22.0 ap369173affected
22.0 ap369863affected
22.0 ap369641affected
22.0 ap368604affected
22.0 ap368087affected
22.0 ap368216affected
22.0 ap369934affected
22.0 ap368326affected
22.0 ap369219affected
22.0 ap369227affected
22.0 ap368422affected
22.0 ap369881affected
22.0 ap369550affected
22.0 ap369668affected
22.0 ap369571affected
22.0 ap372433affected
22.0 ap370654affected
22.0 ap370138affected
22.0 ap370615affected
22.0 ap372643affected
22.0 ap372708affected
22.0 ap370590affected
22.0 ap372390affected
22.0 ap372757affected
22.0 ap370636affected
22.0 ap372750affected
22.0 ap372706affected
22.0 ap370269affected
22.0 ap370180affected
22.0 ap370675affected
22.0 ap370737affected
22.0 ap370424affected
22.0 ap370544affected
22.0 ap374339affected
22.0 ap370459affected
22.0 ap370545affected
22.0 ap370389affected
22.0 ap374803affected
22.0 ap370358affected
22.0 ap373539affected
22.0 ap373118affected
22.0 ap373855affected
22.0 ap373820affected
22.0 ap373438affected
22.0 ap374660affected
22.0 ap373018affected
22.0 ap373954affected
22.0 ap374230affected
22.0 ap374330affected
22.0 ap374460affected
22.0 ap372956affected
22.0 ap373111affected
22.0 ap374114affected
22.0 ap373122affected
22.0 ap373108affected
22.0 ap374356affected
22.0 ap375069affected
22.0 ap373899affected
22.0 ap374971affected
22.0 ap375862affected
22.0 ap375354affected
22.0 ap375688affected
22.0 ap373046affected
22.0 ap373452affected
22.0 ap374334affected
22.0 ap374428affected
22.0 ap374596affected
22.0 ap372963affected
22.0 ap376041affected
22.0 ap376410affected
22.0 ap376298affected
22.0 ap372799affected
22.0 ap376181affected
22.0 ap375090affected
22.0 ap376416affected
22.0 ap373098affected
22.0 ap375937affected
22.0 ap376531affected
22.0 ap375465affected
22.0 ap376100affected
22.0 ap375634affected
22.0 ap375091affected
22.0 ap375018affected
22.0 ap375743affected
22.0 ap375383affected
22.0 ap375719affected
22.0 ap376614affected
22.0 ap376541affected
22.0 ap375685affected
22.0 ap374895affected
22.0 ap376429affected
22.0 ap379838affected
22.0 ap380187affected
22.0 ap380143affected
22.0 ap379972affected
22.0 ap380535affected
22.0 ap380117affected
22.0 ap380473affected
22.0 ap375924affected
22.0 ap379833affected
22.0 ap376661affected
22.0 ap380041affected
22.0 ap380391affected
22.0 ap379795affected
22.0 ap376701affected
22.0 ap376668affected
22.0 ap377384affected
22.0 ap377480affected
22.0 ap377581affected
22.0 ap376652affected
22.0 ap376620affected
22.0 ap378405affected
22.0 ap377494affected
22.0 ap378440affected
22.0 ap378581affected
22.0 ap377307affected
22.0 ap377566affected
22.0 ap378585affected
22.0 ap377149affected
22.0 ap378471affected
22.0 ap377412affected
22.0 ap377068affected
22.0 ap377757affected
22.0 ap378332affected
22.0 ap379016affected
22.0 ap378866affected
22.0 ap378079affected
22.0 ap378509affected
22.0 ap378953affected
22.0 ap377779affected
22.0 ap379008affected
22.0 ap379694affected
22.0 ap379597affected
22.0 ap378882affected
22.0 ap379389affected
22.0 ap379487affected
22.0 ap379374affected
22.0 ap380771affected
22.0 ap381594affected
22.0 ap381243affected
22.0 ap380629affected
22.0 ap380751affected
22.0 ap382158affected
22.0 ap378999affected
22.0 ap381136affected
22.0 ap382240affected
22.0 ap382362affected
22.0 ap382192affected
22.0 ap381091affected
22.0 ap382251affected
22.0 ap381732affected
22.0 ap381584affected
22.0 ap381118affected
22.0 ap382717affected
22.0 ap383569affected
22.0 ap382487affected
22.0 ap383002affected
22.0 ap382434affected
22.0 ap383170affected
22.0 ap383309affected
22.0 ap383514affected
22.0 ap383710affected
22.0 ap382977affected
22.0 ap382488affected
22.0 ap383134affected
22.0 ap359429affected
21.sp1 ap351795affected
21.sp1 ap348143affected
21.sp1 ap351216affected
21.sp1 ap339376affected
21.sp1 ap358132affected
21.sp1 ap355717affected
21.sp1 ap346074affected
21.sp1 ap373102affected
21.sp1 ap235252affected
21.sp1 ap242300affected
21.sp1 ap338964affected
21.sp1 ap339196affected
21.sp1 ap341645affected
21.sp1 ap341897affected
21.sp1 ap342461affected
21.sp1 ap342625affected
21.sp1 ap342755affected
21.sp1 ap342853affected
21.sp1 ap343352affected
21.sp1 ap344270affected
21.sp1 ap344479affected
21.sp1 ap344681affected
21.sp1 ap345054affected
21.sp1 ap345293affected
21.sp1 ap345755affected
21.sp1 ap348472affected
21.sp1 ap349222affected
21.sp1 ap350050affected
21.sp1 ap350189affected
21.sp1 ap351248affected
21.sp1 ap351295affected
21.sp1 ap351530affected
21.sp1 ap351754affected
21.sp1 ap351898affected
21.sp1 ap352082affected
21.sp1 ap352205affected
21.sp1 ap352972affected
21.sp1 ap353418affected
21.sp1 ap353841affected
21.sp1 ap354707affected
21.sp1 ap356271affected
21.sp1 ap356787affected
21.sp1 ap357574affected
21.sp1 ap358730affected
21.sp1 ap360211affected
21.sp1 ap360306affected
21.sp1 ap361420affected
21.sp1 ap365379affected
21.sp1 ap365390affected
21.sp1 ap366348affected
21.sp1 ap374822affected
21.sp1 ap375026affected
21.sp1 ap375053affected
21.0 ap349066affected
21.0 ap364358affected
21.0 ap362637affected
21.0 ap342145affected
21.0 ap357571affected
21.0 ap362825affected
21.0 ap361559affected
21.0 ap339395affected
21.0 ap348945affected
21.0 ap346902affected
21.0 ap350308affected
21.0 ap363301affected
21.0 ap349850affected
21.0 ap344752affected
21.0 ap347640affected
21.0 ap350111affected
21.0 ap355616affected
21.0 ap353841affected
21.0 ap346128affected
21.0 ap350204affected
21.0 ap341897affected
21.0 ap347064affected
21.0 ap350032affected
21.0 ap351261affected
21.0 ap352182affected
21.0 ap350760affected
21.0 ap363408affected
21.sp1 ap340545affected
21.sp1 ap341683affected
21.sp1 ap341909affected
21.sp1 ap342214affected
21.sp1 ap344301affected
21.sp1 ap344783affected
21.sp1 ap346270affected
21.sp1 ap346351affected
21.sp1 ap347928affected
21.sp1 ap349517affected
21.sp1 ap349090affected
21.sp1 ap351315affected
21.sp1 ap352304affected
21.sp1 ap351738affected
21.sp1 ap354194affected
21.sp1 ap357347affected
21.sp1 ap364778affected
21.sp1 ap372422affected
21.sp1 ap371281affected
21.sp1 ap370908affected
21.sp1 ap379493affected
21.sp1 ap380506affected
21.sp9 ap360116affected
21.sp9 ap367207affected
RI.2021.02affected
RI.2021.08affected
RI.2021.09affected
RI.2021.10affected
RI.2021.11affected
RI.2021.12affected
RI.2022.02affected
RI.2022.03affected
RI.2022.04affected
RI.2022.07affected
RI.2022.06affected
RI.2022.05affected
RI.2022.08affected
RI.2022.09affected
RI.2022.10affected
RI.2022.12affected
RI.2023.01affected
RI.2023.03affected
RI.2023.02affected
RI.2023.04affected
RI.2023.05affected
RI.2023.07affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-auth-bypass-kCggMWhX ↗