Nexus Dashboard Cisco Nexus Dashboard

Do you want an email whenever new security vulnerabilities are reported in Cisco Nexus Dashboard?

Recent Cisco Nexus Dashboard Security Advisories

Advisory Title Published
2023-02-15 Cisco Nexus Dashboard Cross-Site Scripting Vulnerability February 15, 2023
2023-02-15 Cisco Nexus Dashboard Denial of Service Vulnerability February 15, 2023
2022-07-20 Cisco Nexus Dashboard Privilege Escalation Vulnerabilities July 20, 2022
2022-07-20 Cisco Nexus Dashboard Unauthorized Access Vulnerabilities July 20, 2022
2022-07-20 Cisco Nexus Dashboard Arbitrary File Write Vulnerability July 20, 2022
2022-07-20 Cisco Nexus Dashboard SSL Certificate Validation Vulnerability July 20, 2022

By the Year

In 2024 there have been 0 vulnerabilities in Cisco Nexus Dashboard . Last year Nexus Dashboard had 2 security vulnerabilities published. Right now, Nexus Dashboard is on track to have less security vulnerabilities in 2024 than it did last year.

Year Vulnerabilities Average Score
2024 0 0.00
2023 2 6.80
2022 9 7.68
2021 1 10.00
2020 0 0.00
2019 0 0.00
2018 0 0.00

It may take a day or so for new Nexus Dashboard vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cisco Nexus Dashboard Security Vulnerabilities

A vulnerability in the web-based management interface of Cisco Nexus Dashboard could

CVE-2023-20053 6.1 - Medium - March 01, 2023

A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

XSS

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could

CVE-2023-20014 7.5 - High - March 01, 2023

A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DNS requests. An attacker could exploit this vulnerability by sending a continuous stream of DNS requests to an affected device. A successful exploit could allow the attacker to cause the coredns service to stop working or cause the device to reload, resulting in a DoS condition.

Resource Exhaustion

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device

CVE-2022-20913 6.5 - Medium - July 22, 2022

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with Administrator credentials could exploit this vulnerability by uploading a crafted file. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.

Improper Input Validation

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device

CVE-2022-20909 6.7 - Medium - July 22, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Improper Input Validation

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device

CVE-2022-20908 6.7 - Medium - July 22, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Improper Input Validation

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device

CVE-2022-20907 6.7 - Medium - July 22, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Improper Privilege Management

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device

CVE-2022-20906 6.7 - Medium - July 22, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.

Improper Privilege Management

Multiple vulnerabilities in Cisco Nexus Dashboard could

CVE-2022-20861 8.8 - High - July 21, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

Session Riding

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could

CVE-2022-20860 7.4 - High - July 21, 2022

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus Dashboard Fabric Controller, formerly Data Center Network Manager (DCNM) controllers. An attacker could exploit this vulnerability by using man-in-the-middle techniques to intercept the traffic between the affected device and the controllers, and then using a crafted certificate to impersonate the controllers. A successful exploit could allow the attacker to alter communications between devices or view sensitive information, including Administrator credentials for these controllers.

Improper Certificate Validation

Multiple vulnerabilities in Cisco Nexus Dashboard could

CVE-2022-20858 9.8 - Critical - July 21, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

Missing Authentication for Critical Function

Multiple vulnerabilities in Cisco Nexus Dashboard could

CVE-2022-20857 9.8 - Critical - July 21, 2022

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.

Missing Authentication for Critical Function

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2

CVE-2021-44228 10 - Critical - December 10, 2021

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Improper Input Validation

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Percussion Rhythmyx or by Cisco? Click the Watch button to subscribe.

Cisco
Vendor

subscribe