6.5

CVE-2022-20656

A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the system.

This vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to write arbitrary files to the host system.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Prime Infrastructure Version2.0.0
Cisco ≫ Prime Infrastructure Version2.1
Cisco ≫ Prime Infrastructure Version2.2
Cisco ≫ Prime Infrastructure Version3.0.0
Cisco ≫ Prime Infrastructure Version3.1.0
Cisco ≫ Prime Infrastructure Version3.1.5
Cisco ≫ Prime Infrastructure Version3.2
Cisco ≫ Prime Infrastructure Version3.2.0-fips
Cisco ≫ Prime Infrastructure Version3.3.0
Cisco ≫ Prime Infrastructure Version3.4.0
Cisco ≫ Prime Infrastructure Version3.5.0
Cisco ≫ Prime Infrastructure Version3.6.0
Cisco ≫ Prime Infrastructure Version3.7.0
Cisco ≫ Prime Infrastructure Version3.8.0
Cisco ≫ Prime Infrastructure Version3.9.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.336
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@cisco.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-24 Path Traversal: '../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.