Sign-up

ID

VAR-202207-1530


CVE

CVE-2022-20908


TITLE

Cisco Nexus Dashboard  Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-015687

DESCRIPTION

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device. Cisco Nexus Dashboard There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Nexus Dashboard is a single console of Cisco (Cisco). It can simplify the operation and management of the data center network

Trust: 1.8

sources: NVD: CVE-2022-20908 // JVNDB: JVNDB-2022-015687 // VULHUB: VHN-405461 // VULMON: CVE-2022-20908

AFFECTED PRODUCTS

vendor:ciscomodel:nexus dashboardscope:gteversion:2.0

Trust: 1.0

vendor:ciscomodel:nexus dashboardscope:ltversion:2.2\(1e\)

Trust: 1.0

vendor:シスコシステムズmodel:cisco nexus dashboardscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco nexus dashboardscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-015687 // NVD: CVE-2022-20908

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20908
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20908
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20908
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202207-2101
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-20908
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20908
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2022-20908
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-015687 // CNNVD: CNNVD-202207-2101 // NVD: CVE-2022-20908 // NVD: CVE-2022-20908

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-367

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-405461 // JVNDB: JVNDB-2022-015687 // NVD: CVE-2022-20908

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-2101

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202207-2101

PATCH

title:cisco-sa-ndb-mprvesc-EMhDgXe5url:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.8

title:Cisco Nexus Dashboard Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=201962

Trust: 0.6

title:Cisco: Cisco Nexus Dashboard Privilege Escalation Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.1

sources: VULMON: CVE-2022-20908 // JVNDB: JVNDB-2022-015687 // CNNVD: CNNVD-202207-2101

EXTERNAL IDS

db:NVDid:CVE-2022-20908

Trust: 3.4

db:JVNDBid:JVNDB-2022-015687

Trust: 0.8

db:CNNVDid:CNNVD-202207-2101

Trust: 0.7

db:CS-HELPid:SB2022072130

Trust: 0.6

db:CNVDid:CNVD-2022-54959

Trust: 0.1

db:VULHUBid:VHN-405461

Trust: 0.1

db:VULMONid:CVE-2022-20908

Trust: 0.1

sources: VULHUB: VHN-405461 // VULMON: CVE-2022-20908 // JVNDB: JVNDB-2022-015687 // CNNVD: CNNVD-202207-2101 // NVD: CVE-2022-20908

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ndb-mprvesc-emhdgxe5

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-20908

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2022072130

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-20908/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-405461 // VULMON: CVE-2022-20908 // JVNDB: JVNDB-2022-015687 // CNNVD: CNNVD-202207-2101 // NVD: CVE-2022-20908

SOURCES

db:VULHUBid:VHN-405461
db:VULMONid:CVE-2022-20908
db:JVNDBid:JVNDB-2022-015687
db:CNNVDid:CNNVD-202207-2101
db:NVDid:CVE-2022-20908

LAST UPDATE DATE

2024-08-14T14:24:39.341000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-405461date:2022-07-29T00:00:00
db:VULMONid:CVE-2022-20908date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015687date:2023-09-28T07:34:00
db:CNNVDid:CNNVD-202207-2101date:2022-08-01T00:00:00
db:NVDid:CVE-2022-20908date:2023-11-07T03:43:17.780

SOURCES RELEASE DATE

db:VULHUBid:VHN-405461date:2022-07-22T00:00:00
db:VULMONid:CVE-2022-20908date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015687date:2023-09-28T00:00:00
db:CNNVDid:CNNVD-202207-2101date:2022-07-20T00:00:00
db:NVDid:CVE-2022-20908date:2022-07-22T04:15:13.283