Cisco NDFC Vulnerability Allows File Tampering

CVE-2024-20477

5.4MEDIUM

Key Information

Vendor
Cisco
Status
Cisco Data Center Network Manager
Vendor
CVE Published:
2 October 2024

Summary

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device.

This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.

Affected Version(s)

Cisco Data Center Network Manager 12.1(1)

Cisco Data Center Network Manager 12.0.1a

Cisco Data Center Network Manager 12.0.2d

References

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.