1. Home
  2. CVE Database
  3. CVE-2024-20441
MEDIUM · 5.7

CVE-2024-20441

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability ...

Vulnerability Description

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to download config only or full backup files and learn sensitive configuration information. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.

CVSS Score

5.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
CiscoNexus Dashboard< 3.2\(1e\)
CiscoNexus Dashboard Fabric Controller>= 12.0.0, < 12.2.2

Related Weaknesses (CWE)

CWE-285

References

FAQ

What is CVE-2024-20441?

CVE-2024-20441 is a vulnerability with a CVSS score of 5.7 (MEDIUM). A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability ...

How severe is CVE-2024-20441?

CVE-2024-20441 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-20441?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nexus Dashboard, Cisco Nexus Dashboard Fabric Controller.