PT-2020-3844 · Cisco · Cisco Enterprise Nfv Infrastructure

Published 2020-09-03 · Updated 2021-10-19 · CVE-2020-3478

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Enterprise NFV Infrastructure Software (NFVIS) (affected versions not specified)

Description: The issue is related to insufficient authorization enforcement in the REST API of the software, allowing an authenticated, remote attacker to overwrite certain files on an affected device. This could be achieved by uploading a file using the REST API, potentially degrading the functionality of the affected system. The vulnerability is also associated with inadequate input validation, which could enable a remote attacker to overwrite arbitrary files in the operating system of a vulnerable device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04206

CVE-2020-3478

Affected Products

Cisco Enterprise Nfv Infrastructure

References · 4

• https://bdu.fstec.ru/vul/2020-04206 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3478 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-file-overwrite-UONzPMkr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3478 · Security Note