CVE-2022-20907
Assigner: cisco
Published: 2022-07-20T00:00:00
State: PUBLISHED
affected: product: Cisco Nexus Dashboard 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2022-07-20T00:00:00
descriptions: value: Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An attacker could exploit these vulnerabilities by authenticating as the rescue-user and executing vulnerable CLI commands using a malicious payload. A successful exploit could allow the attacker to elevate privileges to root on an affected device.
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of these vulnerabilities that are described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-367
description: CWE-367
type: CWE
source: advisory: cisco-sa-ndb-mprvesc-EMhDgXe5
defect: CSCwa75446
CSCwa93561
CSCwa93569
CSCwa93570
discovery: INTERNAL
title: Cisco Nexus Dashboard Privilege Escalation Vulnerabilities