SB2024100317 - Multiple vulnerabilities in Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC)

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2024-20438)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization controls on some REST API endpoints. A remote user can read or write arbitrary files on the target device.

2) Improper Authorization (CVE-ID: CVE-2024-20441)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient authorization controls on the affected REST API endpoint. A remote user can download config only or full backup files and learn sensitive configuration information.

3) Improper Authorization (CVE-ID: CVE-2024-20442)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to insufficient authorization controls on some REST API endpoints. A remote user can perform limited Administrator actions on the target device.

4) Missing Authorization (CVE-ID: CVE-2024-20477)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization controls on the affected REST API endpoint. A remote user can upload or delete arbitrary files on the target device.

Remediation

Install update from vendor's website.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN