PT-2020-2966 · Cisco · Cisco Network Services Orchestrator

Published 2020-06-17 · Updated 2021-08-06 · CVE-2020-3362

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Network Services Orchestrator (NSO) (affected versions not specified)

Description A timing issue in the processing of CLI commands could allow an authenticated, local attacker to access confidential information on an affected device. The issue is related to the lack of protection for internal data. An attacker could exploit this by executing a specific sequence of commands on the CLI, potentially allowing them to read configuration information that would normally be accessible to administrators only.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-03123

CVE-2020-3362

Affected Products

Cisco Network Services Orchestrator

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-info-disclosure-WdNvBTNq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3362 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3362 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03123 · Security Note