HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2024-20536

CVSS 8.8v3.1pub. 2024-11-06upd. 2025-08-07

A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a specific REST API endpoint or web-based management interface. A successful exploit could allow the attacker to read, modify, or delete arbitrary data on an internal database, which could affect the availability of the device. 

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Cisco Nexus Dashboard Fabric Controller

    APP
    Cisco
    12.1.212.1.3
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2024-20432CRITICAL9.9PL ✓ten sam produkt

Command injection w Cisco Nexus Dashboard Fabric Controller (REST API i web UI)

CVE-2024-20449HIGH8.8ten sam produkt

A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacke...

CVE-2024-20348HIGH7.5ten sam produkt

A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controlle...

CVE-2024-20281HIGH7.5ten sam produkt

A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hoste...

CVE-2024-20441MEDIUM5.7ten sam produkt

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, re...