Sign-up

ID

VAR-202207-1533


CVE

CVE-2022-20909


TITLE

Cisco Nexus Dashboard  Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-015685

DESCRIPTION

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device. Cisco Nexus Dashboard There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Nexus Dashboard is a single console of Cisco (Cisco). It can simplify the operation and management of the data center network

Trust: 1.8

sources: NVD: CVE-2022-20909 // JVNDB: JVNDB-2022-015685 // VULHUB: VHN-405462 // VULMON: CVE-2022-20909

AFFECTED PRODUCTS

vendor:ciscomodel:nexus dashboardscope:gteversion:2.0

Trust: 1.0

vendor:ciscomodel:nexus dashboardscope:ltversion:2.2\(1e\)

Trust: 1.0

vendor:シスコシステムズmodel:cisco nexus dashboardscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco nexus dashboardscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-015685 // NVD: CVE-2022-20909

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20909
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20909
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20909
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202207-2148
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-20909
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20909
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2022-20909
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-015685 // CNNVD: CNNVD-202207-2148 // NVD: CVE-2022-20909 // NVD: CVE-2022-20909

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-367

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-405462 // JVNDB: JVNDB-2022-015685 // NVD: CVE-2022-20909

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-2148

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202207-2148

PATCH

title:cisco-sa-ndb-mprvesc-EMhDgXe5url:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.8

title:Cisco Nexus Dashboard Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=201968

Trust: 0.6

title:Cisco: Cisco Nexus Dashboard Privilege Escalation Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.1

sources: VULMON: CVE-2022-20909 // JVNDB: JVNDB-2022-015685 // CNNVD: CNNVD-202207-2148

EXTERNAL IDS

db:NVDid:CVE-2022-20909

Trust: 3.4

db:JVNDBid:JVNDB-2022-015685

Trust: 0.8

db:CNNVDid:CNNVD-202207-2148

Trust: 0.7

db:CS-HELPid:SB2022072130

Trust: 0.6

db:VULHUBid:VHN-405462

Trust: 0.1

db:VULMONid:CVE-2022-20909

Trust: 0.1

sources: VULHUB: VHN-405462 // VULMON: CVE-2022-20909 // JVNDB: JVNDB-2022-015685 // CNNVD: CNNVD-202207-2148 // NVD: CVE-2022-20909

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ndb-mprvesc-emhdgxe5

Trust: 1.9

url:https://nvd.nist.gov/vuln/detail/cve-2022-20909

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2022072130

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-20909/

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-405462 // VULMON: CVE-2022-20909 // JVNDB: JVNDB-2022-015685 // CNNVD: CNNVD-202207-2148 // NVD: CVE-2022-20909

SOURCES

db:VULHUBid:VHN-405462
db:VULMONid:CVE-2022-20909
db:JVNDBid:JVNDB-2022-015685
db:CNNVDid:CNNVD-202207-2148
db:NVDid:CVE-2022-20909

LAST UPDATE DATE

2024-08-14T14:24:39.370000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-405462date:2022-07-29T00:00:00
db:VULMONid:CVE-2022-20909date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015685date:2023-09-28T07:30:00
db:CNNVDid:CNNVD-202207-2148date:2022-08-01T00:00:00
db:NVDid:CVE-2022-20909date:2023-11-07T03:43:17.960

SOURCES RELEASE DATE

db:VULHUBid:VHN-405462date:2022-07-22T00:00:00
db:VULMONid:CVE-2022-20909date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015685date:2023-09-28T00:00:00
db:CNNVDid:CNNVD-202207-2148date:2022-07-21T00:00:00
db:NVDid:CVE-2022-20909date:2022-07-22T04:15:13.347