PT-2020-4239 · Cisco · Cisco Data Center Network Manager

Niklas Jacob + 2 · Published 2020-07-29 · Updated 2020-08-05 · CVE-2020-3461

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description: A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to obtain confidential information from an affected device. The issue is due to missing authentication on a specific part of the interface. An attacker could exploit this by sending a crafted request to the interface, potentially allowing them to read confidential information from an affected device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-308

CWE-306

Related Identifiers

BDU:2020-04679

CVE-2020-3461

Affected Products

Cisco Data Center Network Manager

References · 4

• https://osv.dev/vulnerability/CVE-2020-3461 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-info-disclosure-tFX3KerC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3461 · Security Note
• https://bdu.fstec.ru/vul/2020-04679 · Security Note