High severity · published Nov 18, 2024
CVE-2020-3538
Cisco Data Center Network Manager Path Traversal Vulnerability
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device.
The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to overwrite or list arbitrary files on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CD
Cisco Data Center Network Manager · Cisco
All versions, or not specified · source: vendor
DC
Data Center Network Manager · Cisco
before 11.4\(1\) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3538
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-pa-trav-bMdfSTTq
Not Applicable
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb
More from Cisco Data Center Network Manager
8.8
CVE-2024-20536
Cisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability
8.8
CVE-2024-20449
Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability
8.8
CVE-2024-20432
Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability
8.8
CVE-2024-20281
A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct…
8.7
CVE-2025-20163
Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability