Vulnerability Description
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to the affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Sd-Wan Firmware | <= 19.2.2 |
| Cisco | 1100-4G Integrated Services Router | - |
| Cisco | 1100-4Gltegb Integrated Services Router | - |
| Cisco | 1100-4Gltena Integrated Services Router | - |
| Cisco | 1100-6G Integrated Services Router | - |
| Cisco | Vedge 100 | - |
| Cisco | Vedge 1000 | - |
| Cisco | Vedge 100B | - |
| Cisco | Vedge 100M | - |
| Cisco | Vedge 100Wm | - |
| Cisco | Vedge 2000 | - |
| Cisco | Vedge 5000 | - |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vVendor Advisory
FAQ
What is CVE-2020-3401?
CVE-2020-3401 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensiti...
How severe is CVE-2020-3401?
CVE-2020-3401 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-3401?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Sd-Wan Firmware, Cisco 1100-4G Integrated Services Router, Cisco 1100-4Gltegb Integrated Services Router, Cisco 1100-4Gltena Integrated Services Router, Cisco 1100-6G Integrated Services Router.