Auth Bypass via REST APIs in Cisco Nexus Dashboard
CVE-2024-20442 Published on October 2, 2024

Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited Administrator functions such as viewing portions of the web UI, generating config only or full backup files, and deleting tech support files. This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.

NVD

Vulnerability Analysis

CVE-2024-20442 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2024-20442 has been classified to as an AuthZ vulnerability or weakness.

Products Associated with CVE-2024-20442

stack.watch emails you whenever new vulnerabilities are published in Cisco Nexus Dashboard Fabric Controller or Cisco Nexus Dashboard. Just hit a watch button to start following.

Cisco Nexus Dashboard Fabric Controller

Cisco Nexus Dashboard

Affected Versions

Cisco Nexus Dashboard:

Version 1.1(3e) is affected.
Version 1.1(3c) is affected.
Version 1.1(3d) is affected.
Version 1.1(0d) is affected.
Version 1.1(2i) is affected.
Version 2.0(1b) is affected.
Version 1.1(2h) is affected.
Version 1.1(0c) is affected.
Version 1.1(3f) is affected.
Version 2.1(1d) is affected.
Version 2.1(1e) is affected.
Version 2.0(2g) is affected.
Version 2.0(2h) is affected.
Version 2.1(2d) is affected.
Version 2.0(1d) is affected.
Version 2.2(1h) is affected.
Version 2.2(1e) is affected.
Version 2.2(2d) is affected.
Version 2.1(2f) is affected.
Version 2.3(1c) is affected.
Version 2.3(2b) is affected.
Version 2.3(2c) is affected.
Version 2.3(2d) is affected.
Version 2.3(2e) is affected.
Version 3.0(1f) is affected.
Version 3.0(1i) is affected.
Version 3.1(1k) is affected.
Version 3.1(1l) is affected.

Exploit Probability

EPSS

0.33%

Percentile

55.47%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.