PT-2024-8624 · Cisco · Cisco Nexus Dashboard Fabric Controller

Clayton Gilmer + 2 · Published 2024-10-02 · Updated 2024-10-08 · CVE-2024-20438

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard Fabric Controller (NDFC) versions (affected versions not specified)

Description The issue is related to a lack of authorization in the implementation of the Cisco NDFC platform's application programming interface. This could allow a remote attacker with low privileges to impact the integrity of protected information. The vulnerability exists due to missing authorization controls on some REST API endpoints, which could be exploited by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions, such as reading device configuration information, uploading files, and modifying uploaded files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Missing Authorization

Weakness Enumeration

CWE-693

CWE-862

Related Identifiers

BDU:2024-10212

CVE-2024-20438

Affected Products

Cisco Nexus Dashboard Fabric Controller

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10212 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20438 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20438 · Vendor Advisory
• https://vulners.com/cve/CVE-2024-20438 · Note
• https://twitter.com/CVEnew/status/1841527251780960711 · Twitter Post
• https://github.com/advisories/GHSA-ghg6-rfg3-53g7 · Note
• https://twitter.com/VulmonFeeds/status/1841561419591889076 · Twitter Post