{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20444", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.677Z", "datePublished": "2024-10-02T16:54:09.855Z", "dateUpdated": "2024-10-02T19:45:29.694Z"}, "containers": {"cna": {"title": "Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\r\n \r\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN", "name": "cisco-sa-ndfc-raci-T46k3jnN"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ndfc-raci-T46k3jnN", "discovery": "INTERNAL", "defects": ["CSCwj55173"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "cwe", "cweId": "CWE-88"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Data Center Network Manager", "versions": [{"version": "11.2(1)", "status": "affected"}, {"version": "7.0(2)", "status": "affected"}, {"version": "10.3(2)IPFM", "status": "affected"}, {"version": "10.1(1)", "status": "affected"}, {"version": "7.2(3)", "status": "affected"}, {"version": "7.2(2)", "status": "affected"}, {"version": "7.2(1)", "status": "affected"}, {"version": "11.0(1)", "status": "affected"}, {"version": "10.4(1)", "status": "affected"}, {"version": "10.2(1)", "status": "affected"}, {"version": "7.2(2a)", "status": "affected"}, {"version": "10.1(2)", "status": "affected"}, {"version": "7.1(1)", "status": "affected"}, {"version": "12.1(1)", "status": "affected"}, {"version": "11.1(1)", "status": "affected"}, {"version": "10.3(1)", "status": "affected"}, {"version": "10.3(1)R(1)", "status": "affected"}, {"version": "7.0(1)", "status": "affected"}, {"version": "10.0(1)", "status": "affected"}, {"version": "7.1(2)", "status": "affected"}, {"version": "11.4(1)", "status": "affected"}, {"version": "10.4(2)", "status": "affected"}, {"version": "11.3(1)", "status": "affected"}, {"version": "11.5(1)", "status": "affected"}, {"version": "11.5(2)", "status": "affected"}, {"version": "11.5(3)", "status": "affected"}, {"version": "12.0.1a", "status": "affected"}, {"version": "11.5(3a)", "status": "affected"}, {"version": "12.0.2d", "status": "affected"}, {"version": "12.0.2f", "status": "affected"}, {"version": "11.5(4)", "status": "affected"}, {"version": "12.1.1", "status": "affected"}, {"version": "12.1.1e", "status": "affected"}, {"version": "12.1.1p", "status": "affected"}, {"version": "12.1.2e", "status": "affected"}, {"version": "12.1.2p", "status": "affected"}, {"version": "12.1.3b", "status": "affected"}, {"version": "12.2.1", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-10-02T16:54:09.855Z"}}, "adp": [{"affected": [{"vendor": "cisco", "product": "data_center_network_manager", "cpes": ["cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "11.2(1)", "status": "affected"}, {"version": "7.0(2)", "status": "affected"}, {"version": "10.3(2)IPFM", "status": "affected"}, {"version": "10.1(1)", "status": "affected"}, {"version": "7.2(3)", "status": "affected"}, {"version": "7.2(2)", "status": "affected"}, {"version": "7.2(1)", "status": "affected"}, {"version": "11.0(1)", "status": "affected"}, {"version": "10.4(1)", "status": "affected"}, {"version": "10.2(1)", "status": "affected"}, {"version": "7.2(2a)", "status": "affected"}, {"version": "10.1(2)", "status": "affected"}, {"version": "7.1(1)", "status": "affected"}, {"version": "12.1(1)", "status": "affected"}, {"version": "11.1(1)", "status": "affected"}, {"version": "10.3(1)", "status": "affected"}, {"version": "10.3(1)R(1)", "status": "affected"}, {"version": "7.0(1)", "status": "affected"}, {"version": "10.0(1)", "status": "affected"}, {"version": "7.1(2)", "status": "affected"}, {"version": "11.4(1)", "status": "affected"}, {"version": "10.4(2)", "status": "affected"}, {"version": "11.3(1)", "status": "affected"}, {"version": "11.5(1)", "status": "affected"}, {"version": "11.5(2)", "status": "affected"}, {"version": "11.5(3)", "status": "affected"}, {"version": "12.0.1a", "status": "affected"}, {"version": "11.5(3a)", "status": "affected"}, {"version": "12.0.2d", "status": "affected"}, {"version": "12.0.2f", "status": "affected"}, {"version": "11.5(4)", "status": "affected"}, {"version": "12.1.1", "status": "affected"}, {"version": "12.1.1e", "status": "affected"}, {"version": "12.1.1p", "status": "affected"}, {"version": "12.1.2e", "status": "affected"}, {"version": "12.1.2p", "status": "affected"}, {"version": "12.1.3b", "status": "affected"}, {"version": "12.2.1", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T19:29:46.344080Z", "id": "CVE-2024-20444", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T19:45:29.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20444", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T19:29:46.344080Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "data_center_network_manager", "versions": [{"status": "affected", "version": "11.2(1)"}, {"status": "affected", "version": "7.0(2)"}, {"status": "affected", "version": "10.3(2)IPFM"}, {"status": "affected", "version": "10.1(1)"}, {"status": "affected", "version": "7.2(3)"}, {"status": "affected", "version": "7.2(2)"}, {"status": "affected", "version": "7.2(1)"}, {"status": "affected", "version": "11.0(1)"}, {"status": "affected", "version": "10.4(1)"}, {"status": "affected", "version": "10.2(1)"}, {"status": "affected", "version": "7.2(2a)"}, {"status": "affected", "version": "10.1(2)"}, {"status": "affected", "version": "7.1(1)"}, {"status": "affected", "version": "12.1(1)"}, {"status": "affected", "version": "11.1(1)"}, {"status": "affected", "version": "10.3(1)"}, {"status": "affected", "version": "10.3(1)R(1)"}, {"status": "affected", "version": "7.0(1)"}, {"status": "affected", "version": "10.0(1)"}, {"status": "affected", "version": "7.1(2)"}, {"status": "affected", "version": "11.4(1)"}, {"status": "affected", "version": "10.4(2)"}, {"status": "affected", "version": "11.3(1)"}, {"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "11.5(2)"}, {"status": "affected", "version": "11.5(3)"}, {"status": "affected", "version": "12.0.1a"}, {"status": "affected", "version": "11.5(3a)"}, {"status": "affected", "version": "12.0.2d"}, {"status": "affected", "version": "12.0.2f"}, {"status": "affected", "version": "11.5(4)"}, {"status": "affected", "version": "12.1.1"}, {"status": "affected", "version": "12.1.1e"}, {"status": "affected", "version": "12.1.1p"}, {"status": "affected", "version": "12.1.2e"}, {"status": "affected", "version": "12.1.2p"}, {"status": "affected", "version": "12.1.3b"}, {"status": "affected", "version": "12.2.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T19:45:21.317Z"}}], "cna": {"title": "Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability", "source": {"defects": ["CSCwj55173"], "advisory": "cisco-sa-ndfc-raci-T46k3jnN", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Data Center Network Manager", "versions": [{"status": "affected", "version": "11.2(1)"}, {"status": "affected", "version": "7.0(2)"}, {"status": "affected", "version": "10.3(2)IPFM"}, {"status": "affected", "version": "10.1(1)"}, {"status": "affected", "version": "7.2(3)"}, {"status": "affected", "version": "7.2(2)"}, {"status": "affected", "version": "7.2(1)"}, {"status": "affected", "version": "11.0(1)"}, {"status": "affected", "version": "10.4(1)"}, {"status": "affected", "version": "10.2(1)"}, {"status": "affected", "version": "7.2(2a)"}, {"status": "affected", "version": "10.1(2)"}, {"status": "affected", "version": "7.1(1)"}, {"status": "affected", "version": "12.1(1)"}, {"status": "affected", "version": "11.1(1)"}, {"status": "affected", "version": "10.3(1)"}, {"status": "affected", "version": "10.3(1)R(1)"}, {"status": "affected", "version": "7.0(1)"}, {"status": "affected", "version": "10.0(1)"}, {"status": "affected", "version": "7.1(2)"}, {"status": "affected", "version": "11.4(1)"}, {"status": "affected", "version": "10.4(2)"}, {"status": "affected", "version": "11.3(1)"}, {"status": "affected", "version": "11.5(1)"}, {"status": "affected", "version": "11.5(2)"}, {"status": "affected", "version": "11.5(3)"}, {"status": "affected", "version": "12.0.1a"}, {"status": "affected", "version": "11.5(3a)"}, {"status": "affected", "version": "12.0.2d"}, {"status": "affected", "version": "12.0.2f"}, {"status": "affected", "version": "11.5(4)"}, {"status": "affected", "version": "12.1.1"}, {"status": "affected", "version": "12.1.1e"}, {"status": "affected", "version": "12.1.1p"}, {"status": "affected", "version": "12.1.2e"}, {"status": "affected", "version": "12.1.2p"}, {"status": "affected", "version": "12.1.3b"}, {"status": "affected", "version": "12.2.1"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN", "name": "cisco-sa-ndfc-raci-T46k3jnN"}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\r\n \r\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-88", "description": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-10-02T16:54:09.855Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20444", "state": "PUBLISHED", "dateUpdated": "2024-10-02T19:45:29.694Z", "dateReserved": "2023-11-08T15:08:07.677Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-10-02T16:54:09.855Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E78B4AC-793B-4405-896F-31398AF7CBD2", "versionEndExcluding": "12.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote attacker with network-admin privileges to perform a command injection attack against an affected device.\r\n \r\nThis vulnerability is due to insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted command arguments to a specific REST API endpoint. A successful exploit could allow the attacker to overwrite sensitive files or crash a specific container, which would restart on its own, causing a low-impact denial of service (DoS) condition."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Nexus Dashboard Fabric Controller (NDFC), anteriormente Cisco Data Center Network Manager (DCNM), podr\u00eda permitir que un atacante remoto autenticado con privilegios de administrador de red realice un ataque de inyecci\u00f3n de comandos contra un dispositivo afectado. Esta vulnerabilidad se debe a una validaci\u00f3n insuficiente de los argumentos de los comandos. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando argumentos de comandos manipulados a un endpoint de API REST espec\u00edfico. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante sobrescribir archivos confidenciales o bloquear un contenedor espec\u00edfico, que se reiniciar\u00eda por s\u00ed solo, lo que provocar\u00eda una condici\u00f3n de denegaci\u00f3n de servicio (DoS) de bajo impacto."}], "id": "CVE-2024-20444", "lastModified": "2024-10-08T15:26:38.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2024-10-02T17:15:16.390", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-raci-T46k3jnN"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-88"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}