PT-2024-3859 · Cisco · Cisco Nexus Dashboard

Cooper Timewell · Published 2024-04-03 · Updated 2024-04-03 · CVE-2024-20283

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard (affected versions not specified)

Description The issue is related to insufficient access controls on a specific API endpoint, allowing a remote attacker to gain unauthorized access to protected information by sending specially crafted requests. This could enable an attacker to access metrics and information about devices in the Nexus Dashboard cluster. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Cisco Nexus Dashboard, consider restricting access to the vulnerable API endpoint until a patch is available. As a temporary workaround, avoid using the vulnerable API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-04257

CVE-2024-20283

Affected Products

Cisco Nexus Dashboard

References · 4

• https://osv.dev/vulnerability/CVE-2024-20283 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndidv-LmXdvAf2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04257 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20283 · Security Note