CVE-2020-3333: cisco application_policy_infrastructure_controller

Vulnerability summary

CVE-2020-3333 is a medium (CVSS 5.3) vulnerability in cisco application_policy_infrastructure_controller. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities.

Timeline

1. 03-06-2020
   PublishedVulnerability first disclosed.
2. 15-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affected device. The vulnerability is due to insufficient authentication of users who modify policies on an affected device. An attacker could exploit this vulnerability by crafting a malicious HTTP request to contact an affected device. A successful exploit could allow the attacker to update event policies on the affected device.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.