CVE-2024-20477

Summary

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device.

This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Data Center Network Manager12.1(1)affected
CiscoCisco Data Center Network Manager12.0.1aaffected
CiscoCisco Data Center Network Manager12.0.2daffected
CiscoCisco Data Center Network Manager12.0.2faffected
CiscoCisco Data Center Network Manager12.1.1affected
CiscoCisco Data Center Network Manager12.1.1eaffected
CiscoCisco Data Center Network Manager12.1.1paffected
CiscoCisco Data Center Network Manager12.1.2eaffected
CiscoCisco Data Center Network Manager12.1.2paffected
CiscoCisco Data Center Network Manager12.1.3baffected
CiscoCisco Data Center Network Manager12.2.1affected

Weaknesses

  • CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References