CVE-2024-20324

{"id": "CVE-2024-20324", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-03-27T17:15:53.293", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-wlc-privesc-RjSMrmPK", "source": "ykramarz@cisco.com"}, {"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-wlc-privesc-RjSMrmPK", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-274"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to access WLAN configuration details including passwords.\r\n\r This vulnerability is due to improper privilege checks. An attacker could exploit this vulnerability by using the show and show tech wireless CLI commands to access configuration details, including passwords. A successful exploit could allow the attacker to access configuration details that they are not authorized to access."}, {"lang": "es", "value": "Una vulnerabilidad en la CLI del software Cisco IOS XE podr\u00eda permitir que un atacante local autenticado y con pocos privilegios acceda a los detalles de configuraci\u00f3n de WLAN, incluidas las contrase\u00f1as. Esta vulnerabilidad se debe a comprobaciones de privilegios inadecuadas. Un atacante podr\u00eda aprovechar esta vulnerabilidad utilizando los comandos show y show tech wireless CLI para acceder a los detalles de configuraci\u00f3n, incluidas las contrase\u00f1as. Un exploit exitoso podr\u00eda permitir al atacante acceder a detalles de configuraci\u00f3n a los que no est\u00e1 autorizado a acceder."}], "lastModified": "2024-11-21T08:52:22.527", "sourceIdentifier": "ykramarz@cisco.com"}