CVE-2020-3522

published 2020-08-26

CVE-2020-3522: A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to…

Priority P3 39 medium 6.3 CVSS 3.1

AV N AC L PR L UI N S U C L I L A L

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the affected software allows users to access resources that are intended for administrators only. An attacker could exploit this vulnerability by submitting a crafted URL to an affected device. A successful exploit could allow the attacker to add, delete, and edit certain network configurations in the same manner as a user with administrative privileges.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_data_center_network_manager	—	—
cisco	data_center_network_manager	< 11.4\(1\)	11.4\(1\)
cisco	data_center_network_manager_authorization	—	—

CVSS provenance

nvd v3.1 6.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vendor_cisco 6.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284 CWE-863