CVE-2020-3478: Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
First published: Fri Sep 04 2020(Updated: )
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Enterprise Network Functions Virtualization Infrastructure Software | >=3.5.1<=4.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3478?
CVE-2020-3478 has a medium severity rating due to its potential impact on file integrity.
How do I fix CVE-2020-3478?
To mitigate CVE-2020-3478, ensure that you upgrade Cisco Enterprise NFV Infrastructure Software to a version later than 4.1.2.
Who is affected by CVE-2020-3478?
CVE-2020-3478 affects devices running Cisco Enterprise NFV Infrastructure Software versions 3.5.1 to 4.1.2 inclusive.
What type of attack does CVE-2020-3478 enable?
CVE-2020-3478 allows an authenticated, remote attacker to overwrite restricted files on the affected device.
Is CVE-2020-3478 exploitable without authentication?
No, CVE-2020-3478 requires authentication for an attacker to exploit the vulnerability.
- agent/type
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco enterprise network functions virtualization infrastructure software
- version/cisco enterprise network functions virtualization infrastructure software/3.5.1
- version/cisco enterprise network functions virtualization infrastructure software/4.1.2