CVE-2024-20444 (GCVE-0-2024-20444)

Vulnerability from cvelistv5 – Published: 2024-10-02 16:54 – Updated: 2024-10-02 19:45
VLAI?
Summary
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.   This vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.
Severity ?
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
CWE
  • CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
Vendor Product Version
Cisco Cisco Data Center Network Manager Affected: 11.2(1)
Affected: 7.0(2)
Affected: 10.3(2)IPFM
Affected: 10.1(1)
Affected: 7.2(3)
Affected: 7.2(2)
Affected: 7.2(1)
Affected: 11.0(1)
Affected: 10.4(1)
Affected: 10.2(1)
Affected: 7.2(2a)
Affected: 10.1(2)
Affected: 7.1(1)
Affected: 12.1(1)
Affected: 11.1(1)
Affected: 10.3(1)
Affected: 10.3(1)R(1)
Affected: 7.0(1)
Affected: 10.0(1)
Affected: 7.1(2)
Affected: 11.4(1)
Affected: 10.4(2)
Affected: 11.3(1)
Affected: 11.5(1)
Affected: 11.5(2)
Affected: 11.5(3)
Affected: 12.0.1a
Affected: 11.5(3a)
Affected: 12.0.2d
Affected: 12.0.2f
Affected: 11.5(4)
Affected: 12.1.1
Affected: 12.1.1e
Affected: 12.1.1p
Affected: 12.1.2e
Affected: 12.1.2p
Affected: 12.1.3b
Affected: 12.2.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "data_center_network_manager",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "11.2(1)"
              },
              {
                "status": "affected",
                "version": "7.0(2)"
              },
              {
                "status": "affected",
                "version": "10.3(2)IPFM"
              },
              {
                "status": "affected",
                "version": "10.1(1)"
              },
              {
                "status": "affected",
                "version": "7.2(3)"
              },
              {
                "status": "affected",
                "version": "7.2(2)"
              },
              {
                "status": "affected",
                "version": "7.2(1)"
              },
              {
                "status": "affected",
                "version": "11.0(1)"
              },
              {
                "status": "affected",
                "version": "10.4(1)"
              },
              {
                "status": "affected",
                "version": "10.2(1)"
              },
              {
                "status": "affected",
                "version": "7.2(2a)"
              },
              {
                "status": "affected",
                "version": "10.1(2)"
              },
              {
                "status": "affected",
                "version": "7.1(1)"
              },
              {
                "status": "affected",
                "version": "12.1(1)"
              },
              {
                "status": "affected",
                "version": "11.1(1)"
              },
              {
                "status": "affected",
                "version": "10.3(1)"
              },
              {
                "status": "affected",
                "version": "10.3(1)R(1)"
              },
              {
                "status": "affected",
                "version": "7.0(1)"
              },
              {
                "status": "affected",
                "version": "10.0(1)"
              },
              {
                "status": "affected",
                "version": "7.1(2)"
              },
              {
                "status": "affected",
                "version": "11.4(1)"
              },
              {
                "status": "affected",
                "version": "10.4(2)"
              },
              {
                "status": "affected",
                "version": "11.3(1)"
              },
              {
                "status": "affected",
                "version": "11.5(1)"
              },
              {
                "status": "affected",
                "version": "11.5(2)"
              },
              {
                "status": "affected",
                "version": "11.5(3)"
              },
              {
                "status": "affected",
                "version": "12.0.1a"
              },
              {
                "status": "affected",
                "version": "11.5(3a)"
              },
              {
                "status": "affected",
                "version": "12.0.2d"
              },
              {
                "status": "affected",
                "version": "12.0.2f"
              },
              {
                "status": "affected",
                "version": "11.5(4)"
              },
              {
                "status": "affected",
                "version": "12.1.1"
              },
              {
                "status": "affected",
                "version": "12.1.1e"
              },
              {
                "status": "affected",
                "version": "12.1.1p"
              },
              {
                "status": "affected",
                "version": "12.1.2e"
              },
              {
                "status": "affected",
                "version": "12.1.2p"
              },
              {
                "status": "affected",
                "version": "12.1.3b"
              },
              {
                "status": "affected",
                "version": "12.2.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T19:29:46.344080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T19:45:29.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Data Center Network Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "11.2(1)"
            },
            {
              "status": "affected",
              "version": "7.0(2)"
            },
            {
              "status": "affected",
              "version": "10.3(2)IPFM"
            },
            {
              "status": "affected",
              "version": "10.1(1)"
            },
            {
              "status": "affected",
              "version": "7.2(3)"
            },
            {
              "status": "affected",
              "version": "7.2(2)"
            },
            {
              "status": "affected",
              "version": "7.2(1)"
            },
            {
              "status": "affected",
              "version": "11.0(1)"
            },
            {
              "status": "affected",
              "version": "10.4(1)"
            },
            {
              "status": "affected",
              "version": "10.2(1)"
            },
            {
              "status": "affected",
              "version": "7.2(2a)"
            },
            {
              "status": "affected",
              "version": "10.1(2)"
            },
            {
              "status": "affected",
              "version": "7.1(1)"
            },
            {
              "status": "affected",
              "version": "12.1(1)"
            },
            {
              "status": "affected",
              "version": "11.1(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)"
            },
            {
              "status": "affected",
              "version": "10.3(1)R(1)"
            },
            {
              "status": "affected",
              "version": "7.0(1)"
            },
            {
              "status": "affected",
              "version": "10.0(1)"
            },
            {
              "status": "affected",
              "version": "7.1(2)"
            },
            {
              "status": "affected",
              "version": "11.4(1)"
            },
            {
              "status": "affected",
              "version": "10.4(2)"
            },
            {
              "status": "affected",
              "version": "11.3(1)"
            },
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "11.5(2)"
            },
            {
              "status": "affected",
              "version": "11.5(3)"
            },
            {
              "status": "affected",
              "version": "12.0.1a"
            },
            {
              "status": "affected",
              "version": "11.5(3a)"
            },
            {
              "status": "affected",
              "version": "12.0.2d"
            },
            {
              "status": "affected",
              "version": "12.0.2f"
            },
            {
              "status": "affected",
              "version": "11.5(4)"
            },
            {
              "status": "affected",
              "version": "12.1.1"
            },
            {
              "status": "affected",
              "version": "12.1.1e"
            },
            {
              "status": "affected",
              "version": "12.1.1p"
            },
            {
              "status": "affected",
              "version": "12.1.2e"
            },
            {
              "status": "affected",
              "version": "12.1.2p"
            },
            {
              "status": "affected",
              "version": "12.1.3b"
            },
            {
              "status": "affected",
              "version": "12.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\r\n\u0026nbsp;\r\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-02T16:54:09.855Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ndfc-raci-T46k3jnN",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ndfc-raci-T46k3jnN",
        "defects": [
          "CSCwj55173"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20444",
    "datePublished": "2024-10-02T16:54:09.855Z",
    "dateReserved": "2023-11-08T15:08:07.677Z",
    "dateUpdated": "2024-10-02T19:45:29.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"12.2.2\", \"matchCriteriaId\": \"9E78B4AC-793B-4405-896F-31398AF7CBD2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\\r\\n\u0026nbsp;\\r\\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad en Cisco Nexus Dashboard Fabric Controller (NDFC), anteriormente Cisco Data Center Network Manager (DCNM), podr\\u00eda permitir que un atacante remoto autenticado con privilegios de administrador de red realice un ataque de inyecci\\u00f3n de comandos contra un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\\u00f3n insuficiente de los argumentos de los comandos. Un atacante podr\\u00eda aprovechar esta vulnerabilidad enviando argumentos de comandos manipulados a un endpoint de API REST espec\\u00edfico. Una explotaci\\u00f3n exitosa podr\\u00eda permitir al atacante sobrescribir archivos confidenciales o bloquear un contenedor espec\\u00edfico, que se reiniciar\\u00eda por s\\u00ed solo, lo que provocar\\u00eda una condici\\u00f3n de denegaci\\u00f3n de servicio (DoS) de bajo impacto.\"}]",
      "id": "CVE-2024-20444",
      "lastModified": "2024-10-08T15:26:38.527",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 4.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 4.2}]}",
      "published": "2024-10-02T17:15:16.390",
      "references": "[{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"ykramarz@cisco.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-88\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-88\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-20444\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2024-10-02T17:15:16.390\",\"lastModified\":\"2024-10-08T15:26:38.527\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\\r\\n\u0026nbsp;\\r\\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en Cisco Nexus Dashboard Fabric Controller (NDFC), anteriormente Cisco Data Center Network Manager (DCNM), podr\u00eda permitir que un atacante remoto autenticado con privilegios de administrador de red realice un ataque de inyecci\u00f3n de comandos contra un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de los argumentos de los comandos. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando argumentos de comandos manipulados a un endpoint de API REST espec\u00edfico. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante sobrescribir archivos confidenciales o bloquear un contenedor espec\u00edfico, que se reiniciar\u00eda por s\u00ed solo, lo que provocar\u00eda una condici\u00f3n de denegaci\u00f3n de servicio (DoS) de bajo impacto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":4.2}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-88\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-88\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"12.2.2\",\"matchCriteriaId\":\"9E78B4AC-793B-4405-896F-31398AF7CBD2\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-20444\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-02T19:29:46.344080Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*\"], \"vendor\": \"cisco\", \"product\": \"data_center_network_manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.2(1)\"}, {\"status\": \"affected\", \"version\": \"7.0(2)\"}, {\"status\": \"affected\", \"version\": \"10.3(2)IPFM\"}, {\"status\": \"affected\", \"version\": \"10.1(1)\"}, {\"status\": \"affected\", \"version\": \"7.2(3)\"}, {\"status\": \"affected\", \"version\": \"7.2(2)\"}, {\"status\": \"affected\", \"version\": \"7.2(1)\"}, {\"status\": \"affected\", \"version\": \"11.0(1)\"}, {\"status\": \"affected\", \"version\": \"10.4(1)\"}, {\"status\": \"affected\", \"version\": \"10.2(1)\"}, {\"status\": \"affected\", \"version\": \"7.2(2a)\"}, {\"status\": \"affected\", \"version\": \"10.1(2)\"}, {\"status\": \"affected\", \"version\": \"7.1(1)\"}, {\"status\": \"affected\", \"version\": \"12.1(1)\"}, {\"status\": \"affected\", \"version\": \"11.1(1)\"}, {\"status\": \"affected\", \"version\": \"10.3(1)\"}, {\"status\": \"affected\", \"version\": \"10.3(1)R(1)\"}, {\"status\": \"affected\", \"version\": \"7.0(1)\"}, {\"status\": \"affected\", \"version\": \"10.0(1)\"}, {\"status\": \"affected\", \"version\": \"7.1(2)\"}, {\"status\": \"affected\", \"version\": \"11.4(1)\"}, {\"status\": \"affected\", \"version\": \"10.4(2)\"}, {\"status\": \"affected\", \"version\": \"11.3(1)\"}, {\"status\": \"affected\", \"version\": \"11.5(1)\"}, {\"status\": \"affected\", \"version\": \"11.5(2)\"}, {\"status\": \"affected\", \"version\": \"11.5(3)\"}, {\"status\": \"affected\", \"version\": \"12.0.1a\"}, {\"status\": \"affected\", \"version\": \"11.5(3a)\"}, {\"status\": \"affected\", \"version\": \"12.0.2d\"}, {\"status\": \"affected\", \"version\": \"12.0.2f\"}, {\"status\": \"affected\", \"version\": \"11.5(4)\"}, {\"status\": \"affected\", \"version\": \"12.1.1\"}, {\"status\": \"affected\", \"version\": \"12.1.1e\"}, {\"status\": \"affected\", \"version\": \"12.1.1p\"}, {\"status\": \"affected\", \"version\": \"12.1.2e\"}, {\"status\": \"affected\", \"version\": \"12.1.2p\"}, {\"status\": \"affected\", \"version\": \"12.1.3b\"}, {\"status\": \"affected\", \"version\": \"12.2.1\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-02T19:45:21.317Z\"}}], \"cna\": {\"title\": \"Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability\", \"source\": {\"defects\": [\"CSCwj55173\"], \"advisory\": \"cisco-sa-ndfc-raci-T46k3jnN\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco Data Center Network Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.2(1)\"}, {\"status\": \"affected\", \"version\": \"7.0(2)\"}, {\"status\": \"affected\", \"version\": \"10.3(2)IPFM\"}, {\"status\": \"affected\", \"version\": \"10.1(1)\"}, {\"status\": \"affected\", \"version\": \"7.2(3)\"}, {\"status\": \"affected\", \"version\": \"7.2(2)\"}, {\"status\": \"affected\", \"version\": \"7.2(1)\"}, {\"status\": \"affected\", \"version\": \"11.0(1)\"}, {\"status\": \"affected\", \"version\": \"10.4(1)\"}, {\"status\": \"affected\", \"version\": \"10.2(1)\"}, {\"status\": \"affected\", \"version\": \"7.2(2a)\"}, {\"status\": \"affected\", \"version\": \"10.1(2)\"}, {\"status\": \"affected\", \"version\": \"7.1(1)\"}, {\"status\": \"affected\", \"version\": \"12.1(1)\"}, {\"status\": \"affected\", \"version\": \"11.1(1)\"}, {\"status\": \"affected\", \"version\": \"10.3(1)\"}, {\"status\": \"affected\", \"version\": \"10.3(1)R(1)\"}, {\"status\": \"affected\", \"version\": \"7.0(1)\"}, {\"status\": \"affected\", \"version\": \"10.0(1)\"}, {\"status\": \"affected\", \"version\": \"7.1(2)\"}, {\"status\": \"affected\", \"version\": \"11.4(1)\"}, {\"status\": \"affected\", \"version\": \"10.4(2)\"}, {\"status\": \"affected\", \"version\": \"11.3(1)\"}, {\"status\": \"affected\", \"version\": \"11.5(1)\"}, {\"status\": \"affected\", \"version\": \"11.5(2)\"}, {\"status\": \"affected\", \"version\": \"11.5(3)\"}, {\"status\": \"affected\", \"version\": \"12.0.1a\"}, {\"status\": \"affected\", \"version\": \"11.5(3a)\"}, {\"status\": \"affected\", \"version\": \"12.0.2d\"}, {\"status\": \"affected\", \"version\": \"12.0.2f\"}, {\"status\": \"affected\", \"version\": \"11.5(4)\"}, {\"status\": \"affected\", \"version\": \"12.1.1\"}, {\"status\": \"affected\", \"version\": \"12.1.1e\"}, {\"status\": \"affected\", \"version\": \"12.1.1p\"}, {\"status\": \"affected\", \"version\": \"12.1.2e\"}, {\"status\": \"affected\", \"version\": \"12.1.2p\"}, {\"status\": \"affected\", \"version\": \"12.1.3b\"}, {\"status\": \"affected\", \"version\": \"12.2.1\"}], \"defaultStatus\": \"unknown\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN\", \"name\": \"cisco-sa-ndfc-raci-T46k3jnN\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\\r\\n\u0026nbsp;\\r\\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-88\", \"description\": \"Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2024-10-02T16:54:09.855Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-20444\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-02T19:45:29.694Z\", \"dateReserved\": \"2023-11-08T15:08:07.677Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2024-10-02T16:54:09.855Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.