Sign-up

ID

VAR-202207-1534


CVE

CVE-2022-20907


TITLE

Cisco Nexus Dashboard  Vulnerability in privilege management in

Trust: 0.8

sources: JVNDB: JVNDB-2022-015689

DESCRIPTION

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device. Cisco Nexus Dashboard Exists in a permission management vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Cisco Nexus Dashboard is a single console of Cisco (Cisco). It can simplify the operation and management of the data center network

Trust: 1.8

sources: NVD: CVE-2022-20907 // JVNDB: JVNDB-2022-015689 // VULHUB: VHN-405460 // VULMON: CVE-2022-20907

AFFECTED PRODUCTS

vendor:ciscomodel:nexus dashboardscope:gteversion:2.0

Trust: 1.0

vendor:ciscomodel:nexus dashboardscope:ltversion:2.2\(1e\)

Trust: 1.0

vendor:シスコシステムズmodel:cisco nexus dashboardscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco nexus dashboardscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-015689 // NVD: CVE-2022-20907

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-20907
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20907
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-20907
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202207-2104
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-20907
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2022-20907
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2022-20907
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-015689 // CNNVD: CNNVD-202207-2104 // NVD: CVE-2022-20907 // NVD: CVE-2022-20907

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.1

problemtype:CWE-367

Trust: 1.0

problemtype:Improper authority management (CWE-269) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-405460 // JVNDB: JVNDB-2022-015689 // NVD: CVE-2022-20907

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-2104

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202207-2104

PATCH

title:isco-sa-ndb-mprvesc-EMhDgXe5url:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.8

title:Cisco Nexus Dashboard Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200861

Trust: 0.6

title:Cisco: Cisco Nexus Dashboard Privilege Escalation Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ndb-mprvesc-EMhDgXe5

Trust: 0.1

sources: VULMON: CVE-2022-20907 // JVNDB: JVNDB-2022-015689 // CNNVD: CNNVD-202207-2104

EXTERNAL IDS

db:NVDid:CVE-2022-20907

Trust: 3.4

db:JVNDBid:JVNDB-2022-015689

Trust: 0.8

db:CNNVDid:CNNVD-202207-2104

Trust: 0.7

db:CS-HELPid:SB2022072130

Trust: 0.6

db:VULHUBid:VHN-405460

Trust: 0.1

db:VULMONid:CVE-2022-20907

Trust: 0.1

sources: VULHUB: VHN-405460 // VULMON: CVE-2022-20907 // JVNDB: JVNDB-2022-015689 // CNNVD: CNNVD-202207-2104 // NVD: CVE-2022-20907

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ndb-mprvesc-emhdgxe5

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-20907

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-20907/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072130

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-405460 // VULMON: CVE-2022-20907 // JVNDB: JVNDB-2022-015689 // CNNVD: CNNVD-202207-2104 // NVD: CVE-2022-20907

SOURCES

db:VULHUBid:VHN-405460
db:VULMONid:CVE-2022-20907
db:JVNDBid:JVNDB-2022-015689
db:CNNVDid:CNNVD-202207-2104
db:NVDid:CVE-2022-20907

LAST UPDATE DATE

2024-08-14T14:24:39.454000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-405460date:2022-07-29T00:00:00
db:VULMONid:CVE-2022-20907date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015689date:2023-09-28T07:36:00
db:CNNVDid:CNNVD-202207-2104date:2022-08-10T00:00:00
db:NVDid:CVE-2022-20907date:2023-11-07T03:43:17.613

SOURCES RELEASE DATE

db:VULHUBid:VHN-405460date:2022-07-22T00:00:00
db:VULMONid:CVE-2022-20907date:2022-07-22T00:00:00
db:JVNDBid:JVNDB-2022-015689date:2023-09-28T00:00:00
db:CNNVDid:CNNVD-202207-2104date:2022-07-20T00:00:00
db:NVDid:CVE-2022-20907date:2022-07-22T04:15:13.207