CVE-2024-20438: medium-severity vulnerability in Cisco Data Center Network Manager
Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.4%
A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device.
This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information, uploading files, and modifying uploaded files.
Note: This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Cisco · Cisco Data Center Network ManagerRelated CVEs — Cisco Data Center Network Manager
In the same product, most dangerous first.
CVE-2019-15975CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 96.5%CVE-2019-15976CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilitiesEPSS 92.8%CVE-2019-1620CRITICALCisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution VulnerabilityEPSS 83.8%CVE-2019-1619CRITICALCisco Data Center Network Manager Authentication Bypass VulnerabilityEPSS 82.8%CVE-2019-1622MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 78.9%CVE-2019-15980HIGHCisco Data Center Network Manager Path Traversal VulnerabilitiesEPSS 50.0%