{"id":"CVE-2020-3437","state":"PUBLISHED","title":"Cisco SD-WAN vManage Software Information Disclosure Vulnerability","description":"A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the filesystem of the underlying operating system.","publishedAt":"2020-07-16T17:22:33.436Z","updatedAt":"2024-11-13T18:19:17.447Z","severity":{"score":6.5,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"cisco"},"assigner":"cisco","products":["Cisco Cisco SD-WAN vManage"],"affected":[{"vendor":"Cisco","product":"Cisco SD-WAN vManage","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanwebid-5QWMcCvt","http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html"],"weaknesses":["CWE-59"],"ingestedAt":"2026-10-29T19:47:29.373Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/3xxx/CVE-2020-3437.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-3437","state":"PUBLISHED","datePublished":"2020-07-16T17:22:33.436Z","dateUpdated":"2024-11-13T18:19:17.447Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2019-12-12T00:00:00.000Z"},"containers":{"cna":{"title":"Cisco SD-WAN vManage Software Information Disclosure Vulnerability","descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the filesystem of the underlying operating system."}],"affected":[{"vendor":"Cisco","product":"Cisco SD-WAN vManage","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanwebid-5QWMcCvt","name":"20200715 Cisco SD-WAN vManage Software Information Disclosure Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","description":"CWE-59","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"cisco","dateUpdated":"2021-06-03T17:06:18.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633"},"datePublic":"2020-07-15T00:00:00.000Z","exploits":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-vmanwebid-5QWMcCvt","defect":[["CSCvt65026"]],"discovery":"INTERNAL"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","DATE_PUBLIC":"2020-07-15T16:00:00","ID":"CVE-2020-3437","STATE":"PUBLIC","TITLE":"Cisco SD-WAN vManage Software Information Disclosure Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco SD-WAN vManage","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"Cisco"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the filesystem of the underlying operating system."}]},"exploit":[{"lang":"en","value":"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"impact":{"cvss":{"baseScore":"6.5","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-59"}]}]},"references":{"reference_data":[{"name":"20200715 Cisco SD-WAN vManage Software Information Disclosure Vulnerability","refsource":"CISCO","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanwebid-5QWMcCvt"},{"name":"http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html"}]},"source":{"advisory":"cisco-sa-vmanwebid-5QWMcCvt","defect":[["CSCvt65026"]],"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanwebid-5QWMcCvt","name":"20200715 Cisco SD-WAN vManage Software Information Disclosure Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]},{"url":"http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T07:37:53.976Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-13T17:25:13.106189Z","id":"CVE-2020-3437","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-13T18:19:17.447Z"}}]}}}