CVE-2024-20477: cisco cisco data center network manager Missing Authorization
Vulnerability summary
CVE-2024-20477 is a medium (CVSS 5.4) Missing Authorization vulnerability in cisco cisco data center network manager. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.
Timeline
- 02-10-2024PublishedVulnerability first disclosed.
- 02-10-2024Last modifiedVulnerability information updated.
Description
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could exploit this vulnerability by sending crafted API requests to the affected endpoint. A successful exploit could allow the attacker to upload files into a specific container or delete files from a specific folder within that container. This vulnerability only affects a specific REST API endpoint and does not affect the web-based management interface.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco3 products
- cisco data center network manager12.1.1 | 12.0.1a | 12.0.2d | 12.0.2f | 12.1.1e | 12.1.1p | 12.1.2e | 12.1.2p | 12.1.3b | 12.2.1
- nexus_dashboard< 3.2\(1e\)
- nexus_dashboard_fabric_controller≥ 12.0.0, < 12.2.2
1 vendor · 3 products