PT-2020-5227 · Cisco · Cisco Data Center Network Manager
Published
2020-08-19
·
Updated
2020-08-31
·
CVE-2020-3522
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Cisco Data Center Network Manager (affected versions not specified)
Description
The issue is related to access control errors in the web interface of the system, allowing a remote attacker to bypass authorization and access sensitive device information. The vulnerability exists because the software allows users to access administrator-only resources. An attacker could exploit this by submitting a crafted URL to an affected device, potentially allowing them to add, delete, and edit network configurations with administrative privileges.
Recommendations
For all affected versions, consider restricting access to the web-based management interface until a fix is available.
As a temporary workaround, limit the privileges of non-administrative users to prevent them from accessing sensitive information and network configurations.
Avoid using crafted URLs that could exploit the vulnerability in the web interface.
Fix
Incorrect Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cisco Data Center Network Manager