CVE-2022-20857

CWE-306 — Missing AuthenticationCWE-78 — OS Command InjectionCWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
9.8CRITICAL
EPSS
1.4%
top 19.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Nexus DashboardCisco Cisco Nexus Dashboard
Timeline
PublishedJul 21
Latest updateJul 22

Description

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/nexus_dashboard1.0 — 2.2\(1e\)

🔴Vulnerability Details

2
GHSA
GHSA-xwjg-qxv6-28rv: Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload contai↗2022-07-22
▶
CVEList
Cisco Nexus Dashboard Unauthorized Access Vulnerabilities↗2022-07-21
▶

📋Vendor Advisories

1
Cisco
Cisco Nexus Dashboard Unauthorized Access Vulnerabilities↗2022-07-20
▶