CVE-2024-20283

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 54.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Nexus DashboardCisco Cisco Nexus Dashboard
Timeline
PublishedApr 3

Description

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries to the API endpoint. A successful exploit could allow an attacker to access metrics and information about devices in the Nexus Dashboard cluster.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDcisco/nexus_dashboard< 3.1(1k)
▶CVEListV5cisco/cisco_nexus_dashboard26 versions+25

🔴Vulnerability Details

2
GHSA
GHSA-p979-p78r-6jp8: A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device↗2024-04-03
▶
CVEList
CVE-2024-20283: A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device↗2024-04-03
▶

📋Vendor Advisories

1
Cisco
Cisco Nexus Dashboard Information Disclosure Vulnerability↗2024-04-03
▶