CVE-2020-3401

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to the affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:cisco:sd-wan_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_1000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100b:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_100wm:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_2000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:vedge_5000:-:*:*:*:*:*:*:*

History

23 May 2023, 13:55

Type Values Removed Values Added
First Time Cisco 1100-4gltegb Integrated Services Router
Cisco 1100-4g Integrated Services Router
Cisco 1100-6g Integrated Services Router
Cisco 1100-4gltena Integrated Services Router
CPE cpe:2.3:h:cisco:isr1100-4gltena:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:isr1100-6g:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:isr1100-4gltegb:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:isr1100-4g:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-6g_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-4g_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-4gltegb_integrated_services_router:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:1100-4gltena_integrated_services_router:-:*:*:*:*:*:*:*

Information

Published : 2020-07-16 18:15

Updated : 2023-12-10 13:27


NVD link : CVE-2020-3401

Mitre link : CVE-2020-3401

CVE.ORG link : CVE-2020-3401


JSON object : View

Products Affected

cisco

  • vedge_100b
  • vedge_100
  • vedge_1000
  • sd-wan_firmware
  • vedge_100m
  • 1100-4gltena_integrated_services_router
  • 1100-4g_integrated_services_router
  • vedge_2000
  • vedge_5000
  • vedge_100wm
  • 1100-4gltegb_integrated_services_router
  • 1100-6g_integrated_services_router
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')