CVE-2024-20477

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:nexus_dashboard::::::::
	cpe:2.3:a:cisco:nexus_dashboard_fabric_controller::::::::

History

No history.

Information

Published : 2024-10-02 17:15

Updated : 2024-10-08 16:00

NVD link : CVE-2024-20477

Mitre link : CVE-2024-20477

CVE.ORG link : CVE-2024-20477

JSON object : View

Products Affected

cisco

nexus_dashboard
nexus_dashboard_fabric_controller

CWE

CWE-862

Missing Authorization

{"id": "CVE-2024-20477", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-10-02T17:15:17.130", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device.\r\n\r\nThis vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface."}, {"lang": "es", "value": "Una vulnerabilidad en un endpoint de API REST espec\u00edfico de Cisco NDFC podr\u00eda permitir que un atacante remoto autenticado y con pocos privilegios cargue o elimine archivos en un dispositivo afectado. Esta vulnerabilidad existe debido a la falta de controles de autorizaci\u00f3n en el endpoint de API REST afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando solicitudes de API manipuladas al endpoint afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir que el atacante cargue archivos en un contenedor espec\u00edfico o elimine archivos de una carpeta espec\u00edfica dentro de ese contenedor. Esta vulnerabilidad solo afecta a un endpoint de API REST espec\u00edfico y no afecta a la interfaz de administraci\u00f3n basada en web."}], "lastModified": "2024-10-08T16:00:30.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95C6368B-22DC-4DA0-BD68-90AD842E8D5A", "versionEndExcluding": "3.2\\(1e\\)"}, {"criteria": "cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64448F53-1135-4A69-8FBC-100258CE76BF", "versionEndExcluding": "12.2.2", "versionStartIncluding": "12.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}