SecuriTricks - CVE-2024-20440

Description

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

Product(s) Impacted

Vendor	Product	Versions
Cisco	Smart License Utility	2.0.0, 2.1.0, 2.2.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	cisco	smart_license_utility	2.0.0	/	/	/	/	/	/	/
a	cisco	smart_license_utility	2.1.0	/	/	/	/	/	/	/
a	cisco	smart_license_utility	2.2.0	/	/	/	/	/	/	/

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw

CVSS Score

7.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View Vector String

Timeline

Published: Sept. 4, 2024, 5:15 p.m.
Last Modified: Sept. 19, 2024, 1:42 p.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

ykramarz@cisco.com

CVE-2024-20440