PT-2020-4185 · Cisco · Cisco Ios Xe

Published 2020-09-24 · Updated 2020-11-24 · CVE-2020-3400

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software (affected versions not specified)

Description: The issue is related to insufficient authorization of web UI access requests in the web UI feature of Cisco IOS XE Software. This could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized, potentially enabling a Read-Only user to perform actions of an Admin user. The vulnerability can be exploited by sending a crafted HTTP request to the web UI.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2020-04607

CVE-2020-3400

Affected Products

Cisco Ios Xe

References · 7

• https://osv.dev/vulnerability/CVE-2020-3400 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-auth-bypass-6j2BYUc7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3400 · Security Note
• https://bdu.fstec.ru/vul/2020-04607 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/657130 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-auth-bypass-6j2BYUc7 · Vendor Advisory
• https://t.me/cvenotify/6100 · Telegram Post