CVE-2020-3478: Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-3478?
CVE-2020-3478 has a medium severity rating due to its potential impact on file integrity.
How do I fix CVE-2020-3478?
To mitigate CVE-2020-3478, ensure that you upgrade Cisco Enterprise NFV Infrastructure Software to a version later than 4.1.2.
Who is affected by CVE-2020-3478?
CVE-2020-3478 affects devices running Cisco Enterprise NFV Infrastructure Software versions 3.5.1 to 4.1.2 inclusive.
What type of attack does CVE-2020-3478 enable?
CVE-2020-3478 allows an authenticated, remote attacker to overwrite restricted files on the affected device.
Is CVE-2020-3478 exploitable without authentication?
No, CVE-2020-3478 requires authentication for an attacker to exploit the vulnerability.