CVE-2020-3478CWE-20

CVE-2020-3478

High · published September 4, 2020

CVSS v3.1
8.1
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade the functionality of the affected system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01223 · 68.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-09-04T07:15Z
Affected products (1)
ProductVersionsFixed in
cisco/enterprise_nfv_infrastructure_software≥ 3.5.1, ≤ 4.1.2—
References (2)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-file-overwrite-UONzPMkr · [email protected]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-file-overwrite-UONzPMkr · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 SEP 02:25Z
    Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability
    cvelistv5