Cisco NDFC/NDO Log Information Disclosure of HTTP Proxy Credentials

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Multiple vulnerabilities exist in the logging functionality of Cisco Nexus Dashboard Fabric Controller (NDFC), Cisco Nexus Dashboard Insights, and Cisco Nexus Dashboard Orchestrator (NDO). - These vulnerabilities allow attackers to access technical support files and view sensitive information. 2. Affected Products: - These vulnerabilities affect Cisco NDFC, Cisco Nexus Dashboard Insights, and Cisco NDO, regardless of device configuration. - Starting with Nexus Dashboard Release 3.1(1k), these products are released as part of a unified Nexus Dashboard version. 3. Vulnerability Details: - The vulnerabilities stem from HTTP proxy credentials being logged internally, and these logs are stored within technical support files. - Attackers can exploit these vulnerabilities by accessing technical support files generated from affected systems. - Successful exploitation allows attackers to view admin credentials for the HTTP proxy server, which are configured in plain text on Nexus Dashboard and can provide access to external networks. 4. Solution: - Cisco has released software updates to address these vulnerabilities. - There are no workarounds available for these vulnerabilities. 5. Affected Versions: - Affected versions of NDFC, NDO, and Nexus Dashboard Insights. - Detailed information on affected versions and their corresponding fixed versions is provided. 6. Rating: - CVSS Base Score: 6.3, rated as Medium. - Security Impact Rating: Medium. 7. Source: - These vulnerabilities were discovered during internal security testing. 8. Related Links: - A link to Cisco’s Security Vulnerability Policy is provided. - An option to subscribe to Cisco Security Notifications is available. This information helps users understand the severity of the vulnerability, the affected products and versions, and how to resolve the issues.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco NDFC/NDO Log Information Disclosure of HTTP Proxy Credentials