Vulnerability · Published Apr 3, 2024 · Assigned by cisco

CVE-2024-20282

Medium 6.0

In plain English

A medium-severity privilege mismanagement in Cisco Nexus Dashboard from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.2%top 93.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a sensitive access token. An attacker could exploit this vulnerability by using this token to access resources within the device infrastructure. A successful exploit could allow an attacker to gain root access to the filesystem or hosted containers on an affected device.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Nexus Dashboard	1.1(0c)1.1(0d)1.1(2h)1.1(2i)1.1(3c)1.1(3d)1.1(3e)1.1(3f)

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

cisco-sa-ndru-pesc-kZ2PQLZH