PT-2024-7426 · Cisco · Cisco Nexus Dashboard Fabric Controller+1

Published

2024-10-02

·

Updated

2024-10-08

·

CVE-2024-20490

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) (affected versions not specified)
Description: The issue is related to a logging function in Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) that could allow an attacker to view sensitive information. This is because HTTP proxy credentials could be recorded in an internal log stored in a tech support file. An attacker could exploit this by accessing a tech support file from an affected system, potentially allowing them to view HTTP proxy server admin credentials in clear text. It is a best practice to store debug logs and tech support files safely and share them only with trusted parties, as they may contain sensitive information.
Recommendations: As a temporary workaround, consider restricting access to tech support files and debug logs to minimize the risk of exploitation. Store debug logs and tech support files safely and share them only with trusted parties because they may contain sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200CWE-532

Related Identifiers

BDU:2024-08804
CVE-2024-20490

Affected Products

Cisco Nexus Dashboard Fabric Controller
Cisco Nexus Dashboard Orchestrator