Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2020-3229 | First vendor Publication | 2020-06-03 |
| Vendor | Cve | Last vendor Modification | 2020-06-09 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | |||
|---|---|---|---|
| Overall CVSS Score | 8.8 | ||
| Base Score | 8.8 | Environmental Score | 8.8 |
| impact SubScore | 5.9 | Temporal Score | 8.8 |
| Exploitabality Sub Score | 2.8 | ||
| Attack Vector | Network | Attack Complexity | Low |
| Privileges Required | Low | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | High | Availability Impact | High |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a Read-Only user to execute CLI commands or configuration changes as if they were an Admin user. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3229 |
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2020-12-05 | Cisco IOS XE Web UI command injection attempt RuleID : 51625 - Revision : 4 - Type : SERVER-WEBAPP |
| 2020-12-05 | Cisco IOS XE Web UI command injection attempt RuleID : 51624 - Revision : 4 - Type : SERVER-WEBAPP |
| 2020-12-05 | Cisco IOS XE Web UI command injection attempt RuleID : 51623 - Revision : 4 - Type : SERVER-WEBAPP |
| 2020-12-05 | Cisco IOS XE Web UI command injection attempt RuleID : 51622 - Revision : 4 - Type : SERVER-WEBAPP |
Sources (Detail)
| Source | Url |
|---|---|
| CISCO | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s... |
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 13:51:42 |
|
| 2021-04-22 03:03:02 |
|
| 2020-12-05 21:23:47 |
|
| 2020-06-10 00:22:53 |
|
| 2020-06-04 00:22:52 |
|
