CVE-2020-3485: Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability
First published: Wed Aug 26 2020(Updated: )
A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because the web management software does not properly handle RBAC. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to view and delete certain screen content on the system that the attacker would not normally have privileges to access.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Vision Dynamic Signage Director | =6.2.0-sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-3485.
What is the severity of CVE-2020-3485?
The severity of CVE-2020-3485 is medium (6.3).
What is the affected software?
The affected software is Cisco Vision Dynamic Signage Director version 6.2.0-sp2.
How does the vulnerability in CVE-2020-3485 work?
The vulnerability allows an authenticated, remote attacker to access unauthorized resources and perform actions in the web management software.
Is there a fix available for CVE-2020-3485?
Yes, Cisco has released a security advisory with mitigation details for CVE-2020-3485.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/severity
- agent/author
- agent/references
- agent/title
- agent/description
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/cisco
- canonical/cisco vision dynamic signage director
- version/cisco vision dynamic signage director/6.2.0-sp2