CVE-2024-20365
MEDIUMDescription
A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by sending crafted commands through the Redfish API on an affected device. A successful exploit could allow the attacker to elevate privileges to root.
Is your site exposed to CVE-2024-20365?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
| cisco | unified_computing_system |
References
Frequently Asked Questions
What is CVE-2024-20365? +
How severe is CVE-2024-20365? +
What products are affected by CVE-2024-20365? +
How do I check if I'm vulnerable to CVE-2024-20365? +
Related Vulnerabilities
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments …
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the …
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command …
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found …
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management …
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary …