PT-2020-5182 · Cisco · Cisco Data Center Network Manager

Published 2020-08-19 · Updated 2021-10-19 · CVE-2020-3521

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) Software (affected versions not specified)

Description The issue is related to a vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) Software, which could allow an authenticated, remote attacker to conduct directory traversal attacks. This is due to insufficient validation of user-supplied input to the API. An attacker with a low-privileged account could exploit this by sending a crafted request to the API, potentially allowing them to read arbitrary files on the affected system. The vulnerability may also enable a remote attacker to access protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-05798

CVE-2020-3521

Affected Products

Cisco Data Center Network Manager

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-file-path-6PKONjHe · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3521 · Security Note
• https://bdu.fstec.ru/vul/2020-05798 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3521 · Vendor Advisory