2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"product":"Cisco Data Center Network Manager","vendor":"Cisco","versions":[{"status":"affected","version":"N/A"}]}],"source":"psirt@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cisco:prime_data_center_network_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"246F2BB4-3DBC-4B12-84EC-7672AC77D84E","versionEndExcluding":"11.4\\(1\\)","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization.\r\nThe vulnerability is due to a failure to limit access to resources that are intended for users with Administrator privileges. An attacker could exploit this vulnerability by convincing a user to click a malicious URL. A successful exploit could allow a low-privileged attacker to list, view, create, edit, and delete templates in the same manner as a user with Administrator privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."},{"lang":"es","value":"Una vulnerabilidad en la interfaz de administración basada en web de Cisco Data Center Network Manager (DCNM) podría permitir que un atacante remoto autenticado vea, modifique y elimine datos sin la autorización correspondiente. La vulnerabilidad se debe a un error al limitar el acceso a los recursos destinados a usuarios con privilegios de administrador. Un atacante podría aprovechar esta vulnerabilidad convenciendo a un usuario de que haga clic en una URL maliciosa. Una explotación exitosa podría permitir que un atacante con pocos privilegios enumere, vea, cree, edite y elimine plantillas de la misma manera que un usuario con privilegios de administrador. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad."}],"id":"CVE-2020-3539","lastModified":"2026-06-17T03:18:32.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"psirt@cisco.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2020-3539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-18T16:25:58.727700Z","version":"2.0.3"}}]},"published":"2024-11-18T16:15:07.880","references":[{"source":"psirt@cisco.com","tags":["Vendor Advisory"],"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2"},{"source":"psirt@cisco.com","tags":["Not Applicable"],"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@cisco.com","type":"Secondary"}]}
|