Cisco DCNM XSS Vulnerability Advisory (CVE-2020-3460)

Vulnerability Key Information Basic Information Vulnerability ID: cisco-sa-dcnm-xss-3jkDLsLV CVE Number: CVE-2020-3460 CWE Number: CWE-79 Severity Level: Medium (CVSS Base Score: 4.7) Release Date: July 29, 2020, 16:00 GMT Vulnerability Overview Vulnerability Description: Cisco Data Center Network Manager (DCNM)’s web-based management interface contains a cross-site scripting (XSS) vulnerability. This vulnerability allows an unauthenticated remote attacker to intercept user requests by injecting malicious data into HTTP headers, thereby attacking interface users. Root Cause: The management interface does not properly validate user-supplied input. Risk: Successful exploitation of this vulnerability could enable an attacker to execute arbitrary script code or access sensitive browser-based information. Affected Products Affected Versions: Cisco DCNM software versions prior to 11.4(1). Products Confirmed Not Affected: Only the products listed in the "Affected Products" section are known to be impacted by this vulnerability. Workarounds Workaround: No workarounds are available to address this vulnerability. Published Fixes Fixes: At the time of release, Cisco DCNM software versions 11.4(1) and later include patches to resolve this vulnerability. Disclosure Status Public Exploits and Advisories: Cisco Product Security Incident Response Team (PSIRT) is not aware of any public advisories or malicious use of this vulnerability. Vulnerability Source Reporter: Cisco thanks Suchakra Sharma, Nikolas Schmidt, and Niklas Jacob of ShiftLeft for reporting this vulnerability. Additional Information Details Link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-xss-3jkDLsLV

Goal Reached Thanks to every supporter — we hit 100%!

Cisco DCNM XSS Vulnerability Advisory (CVE-2020-3460)