CVE-2024-20281 is a Cross-Site Request Forgery (CSRF) vulnerability in the web-based management interface of Cisco Nexus Dashboard and its hosted services, including Fabric Controller, Insights, and Orchestrator. This vulnerability, with a CVSS score of 8.8 (High), allows an unauthenticated, remote attacker to perform arbitrary actions with the privileges of an affected user by tricking them into clicking a malicious link. If the user has administrative privileges, this could lead to system configuration modification and creation of new privileged accounts. While the vulnerability is severe, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.1(1k)CPE matchmatch criteria | cpe:2.3:a:cisco:nexus_dashboard:*:*:*:*:*:*:*:* | ||
>= 12.0.0, < 12.2.1CPE matchmatch criteria | cpe:2.3:a:cisco:nexus_dashboard_fabric_controller:*:*:*:*:*:*:*:* | ||
< 6.4.1CPE matchmatch criteria | cpe:2.3:a:cisco:nexus_dashboard_insights:*:*:*:*:*:*:*:* | ||
< 4.3(1.1008)CPE matchmatch criteria | cpe:2.3:a:cisco:nexus_dashboard_orchestrator:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.