CVE-2024-20490
published 2024-10-02CVE-2024-20490: A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker…
PriorityP350high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.28%
19.6th percentile
A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information.
This vulnerability exists because HTTP proxy credentials could be recorded in an internal log that is stored in the tech support file. An attacker could exploit this vulnerability by accessing a tech support file that is generated from an affected system. A successful exploit could allow the attacker to view HTTP proxy server admin credentials in clear text that are configured on Nexus Dashboard to reach an external network.
Note: Best practice is to store debug logs and tech support files safely and to share them only with trusted parties because they may contain sensitive information.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_data_center_network_manager | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
| cisco | cisco_nexus_dashboard_orchestrator | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
vendor_cisco6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
vendor_cisco·2024-10-02·CVSS 6.3
CVE-2024-20490 [MEDIUM] CWE-200 Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
Multiple vulnerabilities in the logging functions of Cisco Nexus Dashboard Fabric Controller (NDFC), Cisco Nexus Dashboard Insights, and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-idv-Bk8VqEDc
Cisco
Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2024-20490 Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
CVE-2024-20490: Cisco Nexus Dashboard Hosted Services Information Disclosure Vulnerabilities
Multiple vulnerabilities in the logging functions of Cisco Nexus Dashboard Fabric Controller (NDFC), Cisco Nexus Dashboard Insights, and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-200, CWE-200
Bug IDs: CSCwk96526, CSCwk96544, CSCwm28892, CSCwk96526, CSCwm28892
GHSA
GHSA-22cv-mr79-8p5c: A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an at
ghsa_unreviewed·2024-10-02
CVE-2024-20490 [MEDIUM] CWE-200 GHSA-22cv-mr79-8p5c: A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an at
A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information.
This vulnerability exists because HTTP proxy credentials could be recorded in an internal log that is stored in the tech support file. An attacker could exploit this vulnerability by accessing a tech support file that is generated from an affected system. A successful exploit could allow the attacker to view HTTP proxy server admin credentials in clear text that are configured on Nexus Dashboard to reach an external network.
Note: Best practice is to store debug logs and tech support files safely and to share them only with trusted parties because they may contain sensi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-02
Published