Search/CVE-2024-20302
● CVE — Medium

CVE-2024-20302

VendorciscoProductnexus dashboard orchestratorDiscoveredApr 3, 2024UpdatedApr 11, 2025

A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attacker to modify or delete tenant templates on an affected system. This vulnerability is due to improper access controls within tenant security. An attacker who is using a valid user account with write privileges and either a Site Manager or Tenant Manager role could exploit this vulnerability. A successful exploit could allow the attacker to modify or delete tenant templates under non-associated tenants, which could disrupt network traffic.

CVSS v3.1
5.4 MEDIUM
EPSS
0.38%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityLOW
AvailabilityLOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Connections
2 relationships
Timeline
disclosure → media coverage
Apr 3, 2024
Disclosure — published as a CVE record. · last revised by NVD Apr 11, 2025