CVE-2023-20247

MEDIUM Year: 2023
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-288
View all →

Vulnerability Description

A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This vulnerability is due to improper error handling during remote access VPN authentication. An attacker could exploit this vulnerability by sending crafted requests during remote access VPN session establishment. A successful exploit could allow the attacker to bypass the configured multiple certificate authentication policy while retaining the privileges and permissions associated with the original connection profile.

Related Vulnerabilities

CVE-2023-30946

MEDIUM
CVSS:4.3(Medium)

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notificati...

CWE-2882023

CVE-2023-4957

MEDIUM
CVSS:4.3(Medium)

A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to chang...

CWE-2882023

CVE-2024-51464

MEDIUM
CVSS:4.3(Medium)

IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotel...

CWE-2882024

CVE-2025-32357

MEDIUM
CVSS:4.3(Medium)

In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for.

CWE-2882025

CVE-2025-48926

MEDIUM
CVSS:4.3(Medium)

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers, as exploited in the wild in May 2025.

CWE-2882025

CVE-2020-14477

MEDIUM
CVSS:4.4(Medium)

In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasoun...

CWE-2882020