CVE-2020-3539: Cisco Data Center Network Manager Authorization Bypass Vulnerability
First published: Mon Nov 18 2024(Updated: )
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. The vulnerability is due to a failure to limit access to resources that are intended for users with Administrator privileges. An attacker could exploit this vulnerability by convincing a user to click a malicious URL. A successful exploit could allow a low-privileged attacker to list, view, create, edit, and delete templates in the same manner as a user with Administrator privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Prime Data Center Network Manager (DCNM) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-3539?
The severity of CVE-2020-3539 is high due to the potential for unauthorized data access and manipulation.
How do I fix CVE-2020-3539?
To fix CVE-2020-3539, update the Cisco Data Center Network Manager to the latest version that addresses this vulnerability.
Who is affected by CVE-2020-3539?
CVE-2020-3539 affects authenticated users of Cisco Data Center Network Manager who can exploit the vulnerability.
What type of attacks can be executed through CVE-2020-3539?
CVE-2020-3539 allows attackers to view, modify, and delete sensitive data without proper authorization.
Is CVE-2020-3539 remote exploitable?
Yes, CVE-2020-3539 is remotely exploitable by an authenticated attacker.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco prime data center network manager (dcnm)