Riskcovery

CVE-2025-20150

Cisco Nexus Dashboard Username Enumeration Vulnerability

State
Published
Severity
5.3 Medium
Published
Apr 16, 2025
Updated
Apr 16, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts.

This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow an attacker to determine which usernames are valid LDAP user accounts.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Ncisco

Weaknesses

  • CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

ProductVersions
Cisco Nexus DashboardCisco
  • 2.1(1d)Affected
  • 2.1(1e)Affected
  • 2.0(2g)Affected
  • 2.0(1b)Affected
  • 2.0(2h)Affected
  • 2.1(2d)Affected
  • 2.0(1d)Affected
  • 2.2(1h)Affected
  • 2.2(1e)Affected
  • 2.2(2d)Affected
  • 2.1(2f)Affected
  • 2.3(1c)Affected
  • 2.3(2b)Affected
  • 2.3(2c)Affected
  • 2.3(2d)Affected
  • 2.3(2e)Affected
  • 3.0(1f)Affected
  • 3.0(1i)Affected
  • 3.1(1k)Affected
  • 3.1(1l)Affected
  • 3.2(1e)Affected
  • 3.2(1i)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.