Vulnerabilities > CVE-2020-3474 - Incorrect Authorization vulnerability in Cisco IOS XE

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-863

NVD

Published: 2020-09-24

Updated: 2023-11-07

Summary

Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash, resulting in a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS XE -	1
Hardware	Cisco Cisco 1100 Integrated Services Router - Cisco 1101 Integrated Services Router - Cisco 1109 Integrated Services Router - Cisco 1111X Integrated Services Router - Cisco 111X Integrated Services Router - Cisco 1120 Integrated Services Router - Cisco 1160 Integrated Services Router - Cisco ASR 1001 HX - Cisco ASR 1001 X - Cisco ASR 1002 HX - Cisco ASR 1002 X - Cisco ASR 1004 - Cisco ASR 1006 - Cisco ASR 1006 X - Cisco ASR 1009 X - Cisco ASR 1013 - Cisco Catalyst 9800 40 - Cisco Catalyst 9800 80 - Cisco Catalyst 9800 CL - Cisco Catalyst 9800 L - Cisco Catalyst 9800 L C - Cisco Catalyst 9800 L F - Cisco Catalyst C9200 24P - Cisco Catalyst C9200 24T - Cisco Catalyst C9200 48P - Cisco Catalyst C9200 48T - Cisco Catalyst C9200L 24P 4G - Cisco Catalyst C9200L 24P 4X - Cisco Catalyst C9200L 24Pxg 2Y - Cisco Catalyst C9200L 24Pxg 4X - Cisco Catalyst C9200L 24T 4G - Cisco Catalyst C9200L 24T 4X - Cisco Catalyst C9200L 48P 4G - Cisco Catalyst C9200L 48P 4X - Cisco Catalyst C9200L 48Pxg 2Y - Cisco Catalyst C9200L 48Pxg 4X - Cisco Catalyst C9200L 48T 4G - Cisco Catalyst C9200L 48T 4X - Cisco Catalyst C9300 24P - Cisco Catalyst C9300 24S - Cisco Catalyst C9300 24T - Cisco Catalyst C9300 24U - Cisco Catalyst C9300 24Ux - Cisco Catalyst C9300 48P - Cisco Catalyst C9300 48S - Cisco Catalyst C9300 48T - Cisco Catalyst C9300 48U - Cisco Catalyst C9300 48Un - Cisco Catalyst C9300 48Uxm - Cisco Catalyst C9300L 24P 4G - Cisco Catalyst C9300L 24P 4X - Cisco Catalyst C9300L 24T 4G - Cisco Catalyst C9300L 24T 4X - Cisco Catalyst C9300L 48P 4G - Cisco Catalyst C9300L 48P 4X - Cisco Catalyst C9300L 48T 4G - Cisco Catalyst C9300L 48T 4X - Cisco Catalyst C9500 12Q - Cisco Catalyst C9500 16X - Cisco Catalyst C9500 24Q - Cisco Catalyst C9500 24Y4C - Cisco Catalyst C9500 32C - Cisco Catalyst C9500 32Qc - Cisco Catalyst C9500 40X - Cisco Catalyst C9500 48Y4C - Cisco WS C3650 12X48Uq - Cisco WS C3650 12X48Ur - Cisco WS C3650 12X48Uz - Cisco WS C3650 24Pd - Cisco WS C3650 24Pdm - Cisco WS C3650 24Ps - Cisco WS C3650 24Td - Cisco WS C3650 24Ts - Cisco WS C3650 48Fd - Cisco WS C3650 48Fq - Cisco WS C3650 48Fqm - Cisco WS C3650 48Fs - Cisco WS C3650 48Pd - Cisco WS C3650 48Pq - Cisco WS C3650 48Ps - Cisco WS C3650 48Td - Cisco WS C3650 48Tq - Cisco WS C3650 48Ts - Cisco WS C3650 8X24Uq - Cisco WS C3850 - Cisco WS C3850 12S - Cisco WS C3850 12X48U - Cisco WS C3850 12Xs - Cisco WS C3850 24P - Cisco WS C3850 24S - Cisco WS C3850 24T - Cisco WS C3850 24U - Cisco WS C3850 24Xs - Cisco WS C3850 24Xu - Cisco WS C3850 48F - Cisco WS C3850 48P - Cisco WS C3850 48T - Cisco WS C3850 48U - Cisco WS C3850 48Xs -	99

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-webui-multi-vfTkk7yr