CVE-2024-20345

State: Published
Severity: 6.5 Medium
Published: Mar 6, 2024
Updated: Aug 26, 2025
Reserved: Nov 8, 2023

Description

A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	cisco
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-26 Path Traversal

Affected Products

Product	Versions
Cisco AppDynamicsCisco	21.2.0Affected 21.2.1Affected 21.2.2Affected 21.2.3Affected 21.2.6Affected 21.2.7Affected 21.2.8Affected 21.4.0Affected 21.4.10Affected 21.4.11Affected 21.4.2Affected 21.4.3Affected 21.4.4Affected 21.4.5Affected 21.4.6Affected 21.4.7Affected 21.4.8Affected 21.4.9Affected 21.11.0Affected 21.5.0Affected 21.6.0Affected 21.12.0Affected 21.12.2Affected 21.12.1Affected 22.1.0Affected and 12 more versions

Product

Versions

Cisco AppDynamicsCisco

21.2.0Affected
21.2.1Affected
21.2.2Affected
21.2.3Affected
21.2.6Affected
21.2.7Affected
21.2.8Affected
21.4.0Affected
21.4.10Affected
21.4.11Affected
21.4.2Affected
21.4.3Affected
21.4.4Affected
21.4.5Affected
21.4.6Affected
21.4.7Affected
21.4.8Affected
21.4.9Affected
21.11.0Affected
21.5.0Affected
21.6.0Affected
21.12.0Affected
21.12.2Affected
21.12.1Affected
22.1.0Affected
and 12 more versions

References

cisco-sa-appd-traversal-m7N8mZpF

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.