PT-2020-5179 · Cisco · Cisco Data Center Network Manager

Published 2020-08-19 · Updated 2024-11-18 · CVE-2020-3539

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. This is due to a failure to limit access to resources intended for users with Administrator privileges. An attacker could exploit this by convincing a user to click a malicious URL, potentially allowing a low-privileged attacker to list, view, create, edit, and delete templates as if they had Administrator privileges.

Recommendations For all affected versions of Cisco Data Center Network Manager (DCNM), update to the latest software version that addresses this vulnerability. At the moment, there is no information about specific workarounds that address this vulnerability.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2020-05794

CVE-2020-3539

Affected Products

Cisco Data Center Network Manager

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05794 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3539 · Security Note
• https://twitter.com/CVEnew/status/1858546020038127637 · Twitter Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2 · Note