Medium severity · published Apr 3, 2024
CVE-2024-20302
A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or delete tenant…
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or delete tenant templates on an affected system.
This vulnerability is due to improper access controls within tenant security. An attacker who is using a valid user account with write privileges and either a Site Manager or Tenant Manager role could exploit this vulnerability. A successful exploit could allow the attacker to modify or delete tenant templates under non-associated tenants, which could disrupt network traffic.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Cisco Nexus Dashboard Orchestrator · Cisco
All versions, or not specified · source: vendor
ND
Nexus Dashboard Orchestrator · Cisco
before 4.2(3e) · source: NVD
Affected product
CN
Cisco Nexus Dashboard Orchestrator
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20302
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndo-upav-YRqsCcSP
More from Cisco Nexus Dashboard Orchestrator
8.8
CVE-2024-20281
A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct…
8.6
CVE-2024-20490
Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability
5.9
CVE-2024-20385
Cisco Nexus Dashboard Orchestrator SSL Certificate Validation Vulnerability
