Cisco Vision Dynamic Signage Director up to 6.2 SP4 path traversal

Summaryinfo

A vulnerability classified as problematic has been found in Cisco Vision Dynamic Signage Director up to 6.2 SP4. Affected by this issue is some unknown functionality. This manipulation causes path traversal. This vulnerability is tracked as CVE-2020-3490. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Cisco Vision Dynamic Signage Director up to 6.2 SP4. It has been declared as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to read files on the underlying operating system with root privileges. To exploit this vulnerability, the attacker would need to have administrative privileges on the affected system.

The weakness was disclosed 08/19/2020 as cisco-sa-cvdsd-pathtrv-5tLJRrF as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2020-3490. The attack can be launched remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Applying the patch 6.2 SP5 is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entry VDB-160113 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Cisco

Name

• Vision Dynamic Signage Director

Version

• 6.2 SP4

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion