Sign-up

ID

VAR-202207-1531


CVE

CVE-2022-20906


TITLE

Cisco Nexus Dashboard  Vulnerability in privilege management in

Trust: 0.8

sources: JVNDB: JVNDB-2022-015691

DESCRIPTION

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device. Cisco Nexus Dashboard Exists in a permission management vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Nexus Dashboard is a single console of Cisco (Cisco). It can simplify the operation and management of the data center network

Trust: 1.8

sources: NVD: CVE-2022-20906 // JVNDB: JVNDB-2022-015691 // VULHUB: VHN-405459 // VULMON: CVE-2022-20906

AFFECTED PRODUCTS

vendor:ciscomodel:nexus dashboardscope:gteversion:2.0

Trust: 1.0

vendor:ciscomodel:nexus dashboardscope:ltversion:2.2\(1e\)

Trust: 1.0

vendor:シスコシステムズmodel:cisco nexus dashboardscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco nexus dashboardscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-015691 // NVD: CVE-2022-20906

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20906
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20906
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20906
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202207-2108
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-20906
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20906
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2022-20906
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-015691 // CNNVD: CNNVD-202207-2108 // NVD: CVE-2022-20906 // NVD: CVE-2022-20906

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.1

problemtype:CWE-367

Trust: 1.0

problemtype:Improper authority management (CWE-269) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-405459 // JVNDB: JVNDB-2022-015691 // NVD: CVE-2022-20906

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-2108

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202207-2108

PATCH

title:cisco-sa-ndb-mprvesc-EMhDgXe5url:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.8

title:Cisco Nexus Dashboard Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200864

Trust: 0.6

title:Cisco: Cisco Nexus Dashboard Privilege Escalation Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.1

sources: VULMON: CVE-2022-20906 // JVNDB: JVNDB-2022-015691 // CNNVD: CNNVD-202207-2108

EXTERNAL IDS

db:NVDid:CVE-2022-20906

Trust: 3.4

db:JVNDBid:JVNDB-2022-015691

Trust: 0.8

db:CNNVDid:CNNVD-202207-2108

Trust: 0.7

db:CS-HELPid:SB2022072130

Trust: 0.6

db:VULHUBid:VHN-405459

Trust: 0.1

db:VULMONid:CVE-2022-20906

Trust: 0.1

sources: VULHUB: VHN-405459 // VULMON: CVE-2022-20906 // JVNDB: JVNDB-2022-015691 // CNNVD: CNNVD-202207-2108 // NVD: CVE-2022-20906

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ndb-mprvesc-emhdgxe5

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-20906

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-20906/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072130

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-405459 // VULMON: CVE-2022-20906 // JVNDB: JVNDB-2022-015691 // CNNVD: CNNVD-202207-2108 // NVD: CVE-2022-20906

SOURCES

db:VULHUBid:VHN-405459
db:VULMONid:CVE-2022-20906
db:JVNDBid:JVNDB-2022-015691
db:CNNVDid:CNNVD-202207-2108
db:NVDid:CVE-2022-20906

LAST UPDATE DATE

2024-08-14T14:24:39.540000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-405459date:2022-07-29T00:00:00
db:VULMONid:CVE-2022-20906date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015691date:2023-09-28T07:38:00
db:CNNVDid:CNNVD-202207-2108date:2022-08-10T00:00:00
db:NVDid:CVE-2022-20906date:2023-11-07T03:43:17.427

SOURCES RELEASE DATE

db:VULHUBid:VHN-405459date:2022-07-22T00:00:00
db:VULMONid:CVE-2022-20906date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015691date:2023-09-28T00:00:00
db:CNNVDid:CNNVD-202207-2108date:2022-07-20T00:00:00
db:NVDid:CVE-2022-20906date:2022-07-22T04:15:13.127