PT-2021-7241 · Cisco · Cisco Appdynamics Controller

Enrico Milanese + 1 · Published 2021-11-02 · Updated 2022-06-27 · CVE-2022-20736

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco AppDynamics Controller Software (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a configuration file and the login page for an administrative console. This issue is due to improper authorization checking for HTTP requests submitted to the affected interface. An attacker could exploit this by sending a crafted HTTP request to an affected instance, potentially allowing access to the administrative console's login page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-939

Related Identifiers

BDU:2022-04059

CVE-2022-20736

Affected Products

Cisco Appdynamics Controller

References · 6

• https://osv.dev/vulnerability/CVE-2022-20736 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-contrl-athzn-bp-BLypgsbu · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20736 · Security Note
• https://bdu.fstec.ru/vul/2022-04059 · Security Note
• https://cybersecurity-help.cz/vdb/SB2022061624 · Note
• https://vuldb.com/?id.202142 · Note