CVE-2020-3333
Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerability
Published 6 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affected device. The vulnerability is due to insufficient authentication of users who modify policies on an affected device. An attacker could exploit this vulnerability by crafting a malicious HTTP request to contact an affected device. A successful exploit could allow the attacker to update event policies on the affected device.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.04% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Affected products
- Cisco Cisco Application Policy Infrastructure Controller (APIC)
Classification
- Weakness
- CWE-306 Missing Authentication for Critical Functionality
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-APIC-EPU-F8y5kUOP · vendor-advisory, x_refsource_CISCO, x_transferred
Sources
- CVE List: CVE-2020-3333
- NVD: CVE-2020-3333
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.