Skip to content
OpenAdvisories
High WID-SEC-2024-3072 11 CVEs

Cisco Nexus Dashboard und Nexus Dashboard Fabric Controller: Mehrere Schwachstellen

Published Oct 3, 2024 · Updated Oct 3, 2024 · de-DE

Vendor: Cisco Product: Nexus Dashboard

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Cisco Nexus Dashboard ausnutzen, um Informationen offenzulegen Sicherheitsmaßnahmen zu umgehen und beliebigen Code, im schlimmsten Fall mit Administratorrechten, zur Ausführung zu bringen.

Product

Cisco Nexus Dashboard ist ein Dashboard für Rechenzentren zur Verwaltung von Hybrid-Cloud-Netzwerken.

Vulnerabilities 11

  • Critical 9.9
    CVE-2024-20432

    Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability

    A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device.   This vulnerability is due to im…

    Cisco Cisco Data Center Network Manager Network devices
  • High 8.8
    CVE-2024-20449

    Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability

    A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This vulnerability is due to improper path validation. An attacker could explo…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 6.3
    CVE-2024-20438

    Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability

    A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints.…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 6.3
    CVE-2024-20448

    Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability

    A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow an attacker with access to a backup file to view sensitive information. This vulnerability is due to the improper st…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 6.3
    CVE-2024-20490

    Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability

    A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because HT…

    Cisco Cisco Data Center Network Manager Cisco Nexus Dashboard Orchestrator Network devices
  • Medium 6.3
    CVE-2024-20491

    Cisco Nexus Dashboard Insights Information Disclosure Vulnerability

    A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because remote controller credentials are recorded in an internal log t…

    Cisco Cisco Nexus Dashboard Insights Network devices
  • Medium 5.9
    CVE-2024-20385

    Cisco Nexus Dashboard Orchestrator SSL Certificate Validation Vulnerability

    A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an unauthenticated, remote attacker to intercept sensitive information from an affected device.  This vulnerability exists because the Cisco NDO Validat…

    Cisco Cisco Nexus Dashboard Orchestrator Network devices
  • Medium 5.7
    CVE-2024-20441

    Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability

    A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected …

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.5
    CVE-2024-20444

    Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability

    A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.…

    Cisco Cisco Data Center Network Manager Network devices
  • Medium 5.4
    CVE-2024-20442

    Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability

    A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls o…

    Cisco Cisco Nexus Dashboard Network devices
  • Medium 5.4
    CVE-2024-20477

    Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability

    A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected RE…

    Cisco Cisco Data Center Network Manager Network devices

Revision history

  1. #1

    Initiale Fassung

References