Cisco DCNM Software Vulnerability: Path Traversal Attacks Ahead

CVE-2020-3538

What is CVE-2020-3538?

A security vulnerability exists in a specific REST API endpoint of Cisco Data Center Network Manager (DCNM) Software, enabling an authenticated remote attacker to conduct path traversal attacks. This issue arises from inadequate enforcement of path restrictions within the API. An attacker could exploit this flaw by sending specially crafted HTTP requests, which may allow them to overwrite or list arbitrary files on the affected device. To mitigate this threat, Cisco has provided software updates designed to resolve the vulnerability. There are currently no alternative workarounds available to address this issue.

References