CVE-2020-3538

A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to overwrite or list arbitrary files on the affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*

History

06 Aug 2025, 14:01

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:data_center_network_manager:*:*:*:*:*:*:*:*
First Time Cisco data Center Network Manager
Cisco
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2 - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2 - Not Applicable
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-pa-trav-bMdfSTTq - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-pa-trav-bMdfSTTq - Vendor Advisory
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhb - Not Applicable
CWE CWE-22

18 Nov 2024, 17:11

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en un determinado punto final de la API REST del software Cisco Data Center Network Manager (DCNM) podría permitir que un atacante remoto autenticado realice un ataque de path traversal en un dispositivo afectado. La vulnerabilidad se debe a una aplicación insuficiente de las restricciones de ruta. Un atacante podría aprovechar esta vulnerabilidad enviando solicitudes HTTP manipuladas a un dispositivo afectado. Una explotación exitosa podría permitir al atacante sobrescribir o enumerar archivos arbitrarios en el dispositivo afectado. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad.

18 Nov 2024, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-11-18 16:15

Updated : 2025-08-06 14:01


NVD link : CVE-2020-3538

Mitre link : CVE-2020-3538

CVE.ORG link : CVE-2020-3538


JSON object : View

Products Affected

cisco

  • data_center_network_manager
CWE
CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')