PT-2022-3784 · Cisco · Cisco Nexus Dashboard

Michael J Davenport · Published 2022-07-20 · Updated 2023-06-27 · CVE-2022-20857

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the Cisco Nexus Dashboard, which could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. A specific vulnerability is associated with a lack of authentication for a critical function in the API interface of the Cisco Nexus Dashboard platform, allowing a remote attacker to execute arbitrary commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-04576

CVE-2022-20857

Affected Products

Cisco Nexus Dashboard

References · 6

• https://bdu.fstec.ru/vul/2022-04576 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20857 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mhcvuln-vpsBPJ9y · Vendor Advisory
• https://t.me/true_secator/3205 · Telegram Post
• https://t.me/thehackernews/2394 · Telegram Post