CVE-2022-20913 Cisco Nexus Dashboard Arbitrary File Write Vulnerability

What is CVE-2022-20913?

CVE-2022-20913 is a medium-severity path traversal vulnerability in Cisco Nexus Dashboard, published on 21 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with Administrator credentials could exploit this vulnerability by uploading a crafted file. A successful exploit could allow the attacker to overwrite arbitrary files on an affected device.

Weakness: CWE-20, CWE-23

Which versions are affected by CVE-2022-20913?

It affects 1 product.

Products include Cisco Nexus Dashboard.

How do I fix CVE-2022-20913?

No fix has been published for CVE-2022-20913 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-20913 being exploited?

There is no known exploitation of CVE-2022-20913 in the wild and no public exploit code.

Other vulnerabilities in Cisco Nexus Dashboard

• CVE-2022-20857 Cisco Nexus Dashboard Unauthorized Access Vulnerabilities Critical 9.8
• CVE-2022-20858 Cisco Nexus Dashboard Unauthorized Access Vulnerabilities Critical 9.8
• CVE-2022-20861 Cisco Nexus Dashboard Unauthorized Access Vulnerabilities Critical 9.8
• CVE-2025-20163 Cisco Nexus Dashboard Fabric Controller SSH Host Key Vulnerability High 8.7
• CVE-2024-20281 Cross-site request forgery in Cisco Data Center Network Manager High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fxf5-95g5-f94p.