CVE-2024-20440: Cisco Smart License Utility, изтичане на данни

Описание

Оригинално описание

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API.

Засегнати продукти

• Cisco Cisco Smart License Utility: 2.1.0; 2.0.0; 2.2.0
• cisco cisco_smart_license_utility: 2.1.0; 2.0.0; 2.2.0

Вид слабост

• CWE-532 Insertion of Sensitive Information into Log File

История

Други уязвимости в Cisco Cisco Smart License Utility

• 9.8CVE-2024-20439

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-20440
• https://nvd.nist.gov/vuln/detail/CVE-2024-20440
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw