CVE-2020-3245: Cisco Smart Software Manager On-Prem Improper Access Control Vulnerability
A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to add user accounts to the configuration of an affected device. These accounts would not be administrator or operator accounts.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-3245?
CVE-2020-3245 is a vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) that could allow an unauthenticated, remote attacker to create arbitrary user accounts.
How does CVE-2020-3245 impact Cisco Smart Software Manager On-Prem?
CVE-2020-3245 could allow an unauthenticated, remote attacker to create arbitrary user accounts in Cisco Smart Software Manager On-Prem due to the lack of authorization controls in the web application.
What is the severity of CVE-2020-3245?
The severity of CVE-2020-3245 is medium with a CVSS score of 5.3.
How can I fix CVE-2020-3245 vulnerability?
To fix CVE-2020-3245, Cisco Smart Software Manager On-Prem users should apply the necessary updates or patches provided by Cisco.
Where can I find more information about CVE-2020-3245?
You can find more information about CVE-2020-3245 on the Cisco Security Advisory website: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-on-prem-access-ctrl-fpQRfdpf