Cisco Data Center Network Manager Authorization Bypass Vulnerability (Cisco Cisco Data Center Network Manager)

CVE-2020-3539
MEDIUM 6.3

En bref

Source
NVD
EPSS
EPSS 0.43 % · centile 37 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Analyzed

Description

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. The vulnerability is due to a failure to limit access to resources that are intended for users with Administrator privileges. An attacker could exploit this vulnerability by convincing a user to click a malicious URL. A successful exploit could allow a low-privileged attacker to list, view, create, edit, and delete templates in the same manner as a user with Administrator privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Faiblesses (CWE)

  • CWE-285 — Autorisation incorrecte

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/RL:X/RC:X/E:Xcisco
CVSS 3.1MEDIUM 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LNVD · psirt@cisco.com (Secondary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco Data Center Network Manageraffected N/A

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD