Cisco AppDynamics up to 23.7.1 Request path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in Cisco AppDynamics. This affects an unknown function of the component Request Handler. This manipulation causes path traversal. This vulnerability is handled as CVE-2024-20345. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco AppDynamics and classified as problematic. Affected by this vulnerability is some unknown functionality of the component Request Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-26. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.

The weakness was released 03/06/2024 as cisco-sa-appd-traversal-m7N8mZpF. The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2024-20345 since 11/08/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Cisco

Name

• AppDynamics

Version

• 21.2.0
• 21.2.1
• 21.2.2
• 21.2.3
• 21.2.6
• 21.2.7
• 21.2.8
• 21.4.0
• 21.4.2
• 21.4.3
• 21.4.4
• 21.4.5
• 21.4.6
• 21.4.7
• 21.4.8
• 21.4.9
• 21.4.10
• 21.4.11
• 21.5.0
• 21.6.0
• 21.7.0
• 21.11.0
• 21.12.0
• 21.12.1
• 21.12.2
• 22.1.0
• 22.1.1
• 22.3.0
• 22.8.0
• 22.10.0
• 22.11.0
• 22.12.0
• 22.12.1
• 23.2.0
• 23.4.0
• 23.7.0
• 23.7.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion