CVE-2024-20440 Cisco Smart Licensing Utility Information Disclosure Vulnerability

2024-09-0416:28:49

cisco

www.cve.org

cisco smart licensing

information disclosure

http request

vulnerability

api access

debug log

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

22.2%

JSON

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.

This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Smart License Utility",
    "versions": [
      {
        "version": "2.1.0",
        "status": "affected"
      },
      {
        "version": "2.0.0",
        "status": "affected"
      },
      {
        "version": "2.2.0",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]