CVE-2024-20302: Cisco NDO tenant security flaw allows template tampering
CVE-2024-20302 Published on April 3, 2024
A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or delete tenant templates on an affected system. This vulnerability is due to improper access controls within tenant security. An attacker who is using a valid user account with write privileges and either a Site Manager or Tenant Manager role could exploit this vulnerability. A successful exploit could allow the attacker to modify or delete tenant templates under non-associated tenants, which could disrupt network traffic.
Vulnerability Analysis
CVE-2024-20302 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2024-20302 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2024-20302
Want to know whenever a new CVE is published for Cisco Nexus Dashboard Orchestrator? stack.watch will email you.
Affected Versions
Cisco Nexus Dashboard Orchestrator Version N/A is affected by CVE-2024-20302Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.