CVE-2022-20860: Cisco Nexus Dashboard SSL Certificate Validation Vulnerability
First published: Thu Jul 21 2022(Updated: )
A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus Dashboard Fabric Controller, formerly Data Center Network Manager (DCNM) controllers. An attacker could exploit this vulnerability by using man-in-the-middle techniques to intercept the traffic between the affected device and the controllers, and then using a crafted certificate to impersonate the controllers. A successful exploit could allow the attacker to alter communications between devices or view sensitive information, including Administrator credentials for these controllers.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Nexus Dashboard | >=1.1<2.2\(1h\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-20860?
The severity of CVE-2022-20860 is high with a CVSS score of 7.4.
How does CVE-2022-20860 affect Cisco Nexus Dashboard?
CVE-2022-20860 affects Cisco Nexus Dashboard by allowing unauthenticated, remote attackers to alter communications or view sensitive information.
What is the affected software for CVE-2022-20860?
The affected software for CVE-2022-20860 is Cisco Nexus Dashboard versions 1.1 to 2.2(1h).
How can the SSL/TLS vulnerability in Cisco Nexus Dashboard be exploited?
The SSL/TLS vulnerability in Cisco Nexus Dashboard can be exploited by an unauthenticated, remote attacker to alter communications or view sensitive information.
Is there a fix available for CVE-2022-20860?
Yes, Cisco has provided a fix for CVE-2022-20860. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/title
- agent/author
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco nexus dashboard
- version/cisco nexus dashboard/1.1