Vulnerability · Published Jun 18, 2020 · Assigned by cisco

CVE-2020-3362Cisco Network Services Orchestrator Information Disclosure Vulnerability

Medium 4.7

In plain English

A medium-severity information exposure in Cisco Network Services Orchestrator from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the CLI of Cisco Network Services Orchestrator (NSO) could allow an authenticated, local attacker to access confidential information on an affected device. The vulnerability is due to a timing issue in the processing of CLI commands. An attacker could exploit this vulnerability by executing a specific sequence of commands on the CLI. A successful exploit could allow the attacker to read configuration information that would normally be accessible to administrators only.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Network Services Orchestrator	n/a

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

20200617 Cisco Network Services Orchestrator Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO