CVE-2022-20913: cisco cisco nexus dashboard Relative Path Traversal

Vulnerability summary

CVE-2022-20913 is a medium (CVSS 6.5) Relative Path Traversal vulnerability in cisco cisco nexus dashboard. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65% of scored vulnerabilities.

Timeline

1. 21-07-2022
   PublishedVulnerability first disclosed.
2. 01-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with Administrator credentials could exploit this vulnerability by uploading a crafted file. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.

• CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.