CVE-2020-3598
published 2020-10-08CVE-2020-3598: A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.94%
56.3th percentile
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_vision_dynamic_signage_director | — | — |
| cisco | vision_dynamic_signage_director | < 6.2.0 | 6.2.0 |
| cisco | vision_dynamic_signage_director | — | — |
| cisco | vision_dynamic_signage_director_missing | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3g6h-m9cp-76w4: A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to acce
ghsa_unreviewed·2022-05-24
CVE-2020-3598 [MEDIUM] GHSA-3g6h-m9cp-76w4: A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to acce
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes.
Cisco
Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
vendor_cisco·2020-10-07·CVSS 6.5
CVE-2020-3598 [MEDIUM] CWE-306 Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes.
The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is avail
Cisco
Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3598 Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
CVE-2020-3598: Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes. The vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to read confidential information or make configuration changes. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-306, CWE-306
Bug IDs: CSCvv21344
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-08
Published