CVE-2022-20921

HIGH 8.8CVE-2022-20921 · Published 25/08/2022 · updated 17/06/2026

In short

CVE-2022-20921 is a HIGH (CVSS 8.8) vulnerability affecting aci multi-site orchestrator (cisco).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.3% of all vulnerabilities.
Fix: update to 3.1\(1n\) or later.

Package	Affected versions	Patched versions
aci multi-site orchestrator cisco	`< 3.1\(1n\)`	`3.1\(1n\)`

Description

A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to improper authorization on specific APIs. An attacker could exploit this vulnerability by sending crafted HTTP requests. A successful exploit could allow an attacker who is authenticated with non-Administrator privileges to elevate to Administrator privileges on an affected device.

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mso-prvesc-BPFp9cZs · Vendor Advisory

More vulnerabilities in aci multi-site orchestrator

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free