CVE-2020-3478
published 2020-09-04CVE-2020-3478: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain…
PriorityP350high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
1.21%
67.2th percentile
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_enterprise_nfv_infrastructure_software | — | — |
| cisco | enterprise_nfv_infrastructure | — | — |
| cisco | enterprise_nfv_infrastructure_software | 3.5.1 – 4.1.2 | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:P
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
vendor_cisco·2020-09-02·CVSS 8.1
CVE-2020-3478 [HIGH] CWE-20 Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device.
The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cis
Cisco
Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3478 Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
CVE-2020-3478: Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-20, CWE-20
Bug IDs: CSCvs54246
VulDB
Cisco Enterprise NFV Infrastructure Software REST API input validation (cisco-sa-nfvis-file-overwrite-)
vuldb·2026-08-24·CVSS 8.1
CVE-2020-3478 [HIGH] Cisco Enterprise NFV Infrastructure Software REST API input validation (cisco-sa-nfvis-file-overwrite-)
A vulnerability, which was classified as critical, was found in Cisco Enterprise NFV Infrastructure Software. This issue affects some unknown processing of the component REST API. Such manipulation leads to improper input validation.
This vulnerability is documented as CVE-2020-3478. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
GHSA-pj8h-h42m-ghq2: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite cer
ghsa_unreviewed·2022-05-24
CVE-2020-3478 [MEDIUM] CWE-20 GHSA-pj8h-h42m-ghq2: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite cer
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-04
Published