{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T19:11:01.510","vulnerabilities":[{"cve":{"id":"CVE-2020-3400","sourceIdentifier":"psirt@cisco.com","published":"2020-09-24T18:15:17.887","lastModified":"2024-11-21T05:30:57.403","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized.The vulnerability is due to insufficient authorization of web UI access requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web UI. A successful exploit could allow the attacker to utilize parts of the web UI for which they are not authorized. This could allow a Read-Only user to perform actions of an Admin user."},{"lang":"es","value":"Una vulnerabilidad en la funcionalidad de la Interfaz de Usuario web de Cisco IOS XE Software, podría permitir a un atacante remoto autenticado usar partes de la Interfaz de Usuario web para las que no está autorizado. La vulnerabilidad es debido a una autorización insuficiente de las peticiones de acceso a la Interfaz de Usuario web. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP diseñada hacia la interfaz de la Interfaz de Usuario web. Una explotación con éxito podría permitir al atacante utilizar partes de la petición web para las que no está autorizado. Esto podría permitir a un usuario de solo lectura realizar acciones de un usuario administrador."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"psirt@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*","matchCriteriaId":"302933FE-4B6A-48A3-97F0-4B943251B717"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.1:*:*:*:*:*:*:*","matchCriteriaId":"296636F1-9242-429B-8472-90352C056106"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.1a:*:*:*:*:*:*:*","matchCriteriaId":"77993343-0394-413F-ABF9-C1215E9AD800"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.2:*:*:*:*:*:*:*","matchCriteriaId":"283971DD-DD58-4A76-AC2A-F316534ED416"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.3:*:*:*:*:*:*:*","matchCriteriaId":"A8F324A5-4830-482E-A684-AB3B6594CEAE"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.4:*:*:*:*:*:*:*","matchCriteriaId":"E8120196-8648-49D0-8262-CD4C9C90C37A"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.5:*:*:*:*:*:*:*","matchCriteriaId":"33E7CCE2-C685-4019-9B55-B3BECB3E5F76"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.5b:*:*:*:*:*:*:*","matchCriteriaId":"0699DD6E-BA74-4814-93AB-300329C9D032"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.6:*:*:*:*:*:*:*","matchCriteriaId":"C2E2D781-2684-45F1-AC52-636572A0DCA8"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.7:*:*:*:*:*:*:*","matchCriteriaId":"479FB47B-AF2E-4FCB-8DE0-400BF325666C"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.8:*:*:*:*:*:*:*","matchCriteriaId":"DF2B4C78-5C31-4F3D-9639-305E15576E79"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.9:*:*:*:*:*:*:*","matchCriteriaId":"2C09F0A2-B21F-40ED-A6A8-9A29D6E1C6A8"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.10:*:*:*:*:*:*:*","matchCriteriaId":"32BA13F4-EF9C-4368-B8B1-9FD9FAF5CEFF"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:16.3.11:*:*:*:*:*:*:*","matchCriteriaId":"13CB889F-B064-4CAC-99AC-903745ACA566"},{"vulnerable":true,"criteria":"cpe:2.3:o:cisco:ios_xe:17.2.1t:*:*:*:*:*:*:*","matchCriteriaId":"2F9CEEED-FB12-4554-AD5F-1198E1698660"}]}]}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-auth-bypass-6j2BYUc7","source":"psirt@cisco.com","tags":["Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-auth-bypass-6j2BYUc7","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}