CVE-2020-3365 is a vulnerability in Cisco Enterprise Network Function Virtualization Infrastructure
Published on September 4, 2020
Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability
A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directory permissions. An attacker could exploit this vulnerability by using capabilities that are not controlled by the role-based access control (RBAC) mechanisms of the software. A successful exploit could allow the attacker to overwrite files on an affected device.
Vulnerability Analysis
CVE-2020-3365 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2020-3365 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2020-3365
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-3365 are published in Cisco Enterprise Network Function Virtualization Infrastructure:
Affected Versions
Cisco Enterprise NFV Infrastructure Software Version n/a is affected by CVE-2020-3365Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.