CVE-2020-3485: medium-severity vulnerability in Cisco Vision Dynamic Signage Director
Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.7%
A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because the web management software does not properly handle RBAC. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to view and delete certain screen content on the system that the attacker would not normally have privileges to access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Cisco · Cisco Vision Dynamic Signage DirectorRelated CVEs — Cisco Vision Dynamic Signage Director
In the same product, most dangerous first.
CVE-2019-1917CRITICALCisco Vision Dynamic Signage Director REST API Authentication Bypass VulnerabilityEPSS 5.3%CVE-2020-3490MEDIUMCisco Vision Dynamic Signage Director Path Traversal VulnerabilityEPSS 3.0%CVE-2020-3484MEDIUMCisco Vision Dynamic Signage Director Directory Traversal Information Disclosure VulnerabilityEPSS 1.1%CVE-2019-16004MEDIUMCisco Vision Dynamic Signage Director Authentication Bypass VulnerabilityEPSS 1.0%CVE-2020-3450MEDIUMCisco Vision Dynamic Signage Director SQL Injection VulnerabilityEPSS 1.0%CVE-2020-3598MEDIUMCisco Vision Dynamic Signage Director Missing Authentication VulnerabilityEPSS 0.9%