CVE-2020-3539

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. The vulnerability is due to a failure to limit access to resources that are intended for users with Administrator privileges. An attacker could exploit this vulnerability by convincing a user to click a malicious URL. A successful exploit could allow a low-privileged attacker to list, view, create, edit, and delete templates in the same manner as a user with Administrator privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

• CWE-285

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-authbypass-YVJzqgk2Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-tls-dos-xW53TBhbNot Applicable

Published

Nov 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35378SQL Injection in the login page in Online Bus Ticket Reserva…9.8
• CVE-2020-3538A vulnerability in a certain REST API endpoint of Cisco&nbsp…8.1
• CVE-2020-35380GJSON before 1.6.4 allows attackers to cause a denial of ser…7.5
• CVE-2020-35381jsonparser 1.0.0 allows attackers to cause a denial of servi…7.5
• CVE-2020-35382SQL Injection in Classbooking before 2.4.1 via the username …7.2
• CVE-2020-35388rainrocka xinhu 2.1.9 allows remote attackers to obtain sens…7.5
• CVE-2020-35391Tenda N300 F3 12.01.01.48 devices allow remote attackers to …6.5
• CVE-2020-35395XSS in the Add Expense Component of EGavilan Media Expense M…6.1
• CVE-2020-35396EGavilan Barcodes generator 1.0 is affected by: Cross Site S…6.1
• CVE-2020-35398An issue was discovered in UTI Mutual fund Android applicati…5.3
• CVE-2020-3541A vulnerability in the media engine component of Cisco Webex…4.4
• CVE-2020-35416Multiple cross-site scripting (XSS) vulnerabilities exist in…6.1