A vulnerability classified as critical was found in Cisco Data Center Network Manager (version unknown). Affected by this vulnerability is an unknown function of the component Archive Utility. The manipulation as part of a Archive File leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to a lack of proper input validation of paths that are embedded within archive files. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to write arbitrary files in the system with the privileges of the logged-in user.

The weakness was shared 07/31/2020 as cisco-sa-dcnm-path-trav-2xZOnJ as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2020-3383 since 12/12/2019. The attack can be launched remotely. The successful exploitation requires a single authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

The entries 159233, 159232, 159231 and 159230 are related to this item.

Productinfo

Vendor

• Cisco

Name

• Data Center Network Manager

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion