2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"product":"NA","vendor":"Cisco","versions":[{"lessThan":"n/a","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"psirt@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cisco:enterprise_nfv_infrastructure_software:*:*:*:*:*:*:*:*","matchCriteriaId":"C54182EA-1107-48A8-9188-9040D04BE5C4","versionEndIncluding":"3.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a malicious file when upgrading. The vulnerability is due to insufficient signature validation. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to upload crafted code to the affected device."},{"lang":"es","value":"Una vulnerabilidad en el componente upgrade de Cisco Enterprise NFV Infrastructure Software (NFVIS), podría permitir a un atacante local autenticado instalar un archivo malicioso durante la actualización. La vulnerabilidad es debido a una comprobación de firma insuficiente. Un atacante podría explotar esta vulnerabilidad al proporcionar un archivo de actualización diseñado. Una explotación con éxito podría permitir al atacante cargar código diseñado hacia el dispositivo afectado."}],"id":"CVE-2020-3138","lastModified":"2026-08-24T18:22:58.150","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":7.2,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":3.9,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2020-3138","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-11-15T16:25:07.103375Z","version":"2.0.3"}}]},"published":"2020-02-19T20:15:15.050","references":[{"source":"psirt@cisco.com","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-codex-shs4NhvS"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-codex-shs4NhvS"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@cisco.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-347"}],"source":"nvd@nist.gov","type":"Primary"}]}
|