CVE-2020-3522— Cisco Data Center Network Manager Web管理接口访问控制错误漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2020-3522の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Cisco Data Center Network Manager Authorization Bypass Vulnerability
ソース: NVD (National Vulnerability Database)
脆弱性説明
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device. The vulnerability exists because the affected software allows users to access resources that are intended for administrators only. An attacker could exploit this vulnerability by submitting a crafted URL to an affected device. A successful exploit could allow the attacker to add, delete, and edit certain network configurations in the same manner as a user with administrative privileges.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
访问控制不恰当
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Cisco Data Center Network Manager Web管理接口访问控制错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Cisco Data Center Network Manager（DCNM）是美国思科（Cisco）公司的一套数据中心管理系统。该系统适用于Cisco Nexus和MDS系列交换机，提供存储可视化、配置和故障排除等功能。 Cisco DCNM 11.4(1)之前版本中的Web管理接口存在访问控制错误漏洞，该漏洞源于程序没有限制只有管理员才可访问到的资源。远程攻击者可借助特制的URL利用该漏洞绕过授权并访问敏感信息。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Cisco | Cisco Data Center Network Manager | n/a | - |
II. CVE-2020-3522の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2020-3522のインテリジェンス情報
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-auth-bypass-MYeFpFcFvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2020-3522
Same Patch Batch · Cisco · 2020-08-26 · 22 CVEs total
| CVE-2020-3507 | 8.8 HIGH | Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execu |
| CVE-2020-3506 | 8.8 HIGH | Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execu |
| CVE-2020-3443 | 8.8 HIGH | Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability |
| CVE-2020-3523 | 6.5 MEDIUM | Cisco Data Center Network Manager Cross-Site Scripting Vulnerability |
| CVE-2020-3518 | 6.5 MEDIUM | Cisco Data Center Network Manager Cross-Site Scripting Vulnerability |
| CVE-2020-3505 | 6.5 MEDIUM | Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulne |
| CVE-2020-3485 | 6.3 MEDIUM | Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability |
| CVE-2020-3491 | 5.5 MEDIUM | Cisco Vision Dynamic Signage Director Stored Cross-Site Scripting Vulnerability |
| CVE-2020-3520 | 5.5 MEDIUM | Cisco Data Center Network Manager Information Disclosure Vulnerability |
| CVE-2020-3484 | 5.3 MEDIUM | Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerabi |
| CVE-2020-3521 | 5.3 MEDIUM | Cisco Data Center Network Manager Read File Path Traversal Vulnerability |
| CVE-2020-3490 | 4.9 MEDIUM | Cisco Vision Dynamic Signage Director Path Traversal Vulnerability |
| CVE-2020-3466 | Cisco DNA Center Cross-Site Scripting Vulnerabilities | |
| CVE-2020-3151 | Cisco Connected Mobile Experiences Restricted Shell Escape Vulnerability | |
| CVE-2020-3496 | Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability | |
| CVE-2020-3446 | Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnera | |
| CVE-2020-3440 | Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability | |
| CVE-2020-3439 | Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability | |
| CVE-2020-3389 | Cisco Hyperflex HX-Series Software Weak Storage Vulnerability | |
| CVE-2020-3519 | Cisco Data Center Network Manager Path Traversal Vulnerability |
Showing 20 of 22 CVEs. View all on vendor page →
IV. 関連脆弱性
- CVE-2025-20347
Cisco Nexus Dashboard Fabric Controller Unauthorized REST AP - CVE-2025-20163
Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnera - CVE-2020-3538
Cisco Data Center Network Manager Path Traversal Vulnerabil - CVE-2020-3539
Cisco Data Center Network Manager Authorization Bypass Vulne - CVE-2024-20536
Cisco Nexus Dashboard Fabric Controller SQL Injection Vulner
同じベンダー: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
同じ弱点: CWE-284
- CVE-2026-8233
Dotouch XproUPF access control - CVE-2026-42569
phpvms: /importer authorization bypass causing full database - CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr - CVE-2026-41487
Langfuse: Improper role-based-access control in Langfuse LLM - CVE-2026-42278
UltraDAG: Smart Account Spending Policy Bypass via Pockets
V. CVE-2020-3522へのコメント
まだコメントはありません