CVE-2020-3522

CWE-284 — Improper Access Control CWE-863 — Incorrect Authorization4 documents4 sources

Severity

6.3MEDIUM

EPSS

0.2%

top 63.69%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Data Center Network Manager Cisco Cisco Data Center Network Manager

Timeline

PublishedAug 26

Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the affected software allows users to access resources that are intended for administrators only. An attacker could exploit this vulnerability by submitting a crafted URL to an affected device. A successf…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDcisco/data_center_network_manager< 11.4\(1\)

▶CVEListV5cisco/cisco_data_center_network_managern/a

🔴Vulnerability Details

GHSA

GHSA-r4m4-hfr3-7238: A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attack↗2022-05-24

▶

CVEList

Cisco Data Center Network Manager Authorization Bypass Vulnerability↗2020-08-26

▶

📋Vendor Advisories

Cisco

Cisco Data Center Network Manager Authorization Bypass Vulnerability↗2020-08-19

▶