PT-2024-8626 · Cisco · Cisco Nexus Dashboard

Published 2024-10-02 · Updated 2024-10-07 · CVE-2024-20442

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard (affected versions not specified)

Description A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This issue is due to insufficient authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint, potentially allowing them to perform limited Administrator functions such as viewing portions of the web UI, generating config only or full backup files, and deleting tech support files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-10214

CVE-2024-20442

Affected Products

Cisco Nexus Dashboard

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20442 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20442 · Vendor Advisory
• https://github.com/advisories/GHSA-fqfx-6m93-92cg · Note
• https://twitter.com/VulmonFeeds/status/1841563981254721599 · Twitter Post
• https://t.me/cvedetector/6860 · Telegram Post
• https://vulners.com/cve/CVE-2024-20442 · Note
• https://twitter.com/CVEnew/status/1841527249750909187 · Twitter Post