Cisco Data Center Network Manager Web-based Management Interface Stored cross site scripting

Summaryinfo

A vulnerability was found in Cisco Data Center Network Manager. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web-based Management Interface. The manipulation leads to cross site scripting (Stored). This vulnerability is referenced as CVE-2020-3354. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco Data Center Network Manager (version unknown). It has been rated as problematic. This issue affects an unknown function of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need administrative credentials on the affected device.

The weakness was published 06/18/2020 as cisco-sa-dcnm-stored-xss-VyE4b as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2020-3354 since 12/12/2019. The attack may be initiated remotely. The successful exploitation requires a simple authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-156907 and VDB-156906. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Data Center Network Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion