CVE-2024-20333

State: Published
Severity: 4.3 Medium
Published: Mar 27, 2024
Updated: Aug 1, 2024
Reserved: Nov 8, 2023

Description

A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to change specific data within the interface on an affected device. This vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to change a specific field within the web-based management interface, even though they should not have access to change that field.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Cisco Digital Network Architecture Center (DNA Center)Cisco	2.1.2.0Affected 2.1.2.3Affected 2.1.2.4Affected 2.1.2.5Affected 2.1.2.6Affected 2.1.2.7Affected 2.1.2.8Affected 2.2.2.3Affected 2.2.1.3Affected 2.2.2.4Affected 2.2.2.5Affected 2.2.2.8Affected 2.2.3.4Affected 2.2.3.3Affected 2.2.2.6Affected 2.2.3.5Affected 2.2.2.9Affected 2.2.3.6Affected 2.3.3.4Affected 2.3.3.5Affected 2.3.3.6Affected 2.3.3.7Affected 2.3.5.3Affected VA Launchpad 1.2.1Affected VA Launchpad 1.3.0Affected and 1 more version

Product

Versions

Cisco Digital Network Architecture Center (DNA Center)Cisco

2.1.2.0Affected
2.1.2.3Affected
2.1.2.4Affected
2.1.2.5Affected
2.1.2.6Affected
2.1.2.7Affected
2.1.2.8Affected
2.2.2.3Affected
2.2.1.3Affected
2.2.2.4Affected
2.2.2.5Affected
2.2.2.8Affected
2.2.3.4Affected
2.2.3.3Affected
2.2.2.6Affected
2.2.3.5Affected
2.2.2.9Affected
2.2.3.6Affected
2.3.3.4Affected
2.3.3.5Affected
2.3.3.6Affected
2.3.3.7Affected
2.3.5.3Affected
VA Launchpad 1.2.1Affected
VA Launchpad 1.3.0Affected
and 1 more version

References

cisco-sa-ccc-authz-bypass-5EKchJRb

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.