CVE-2024-20345
Cisco Appdynamics Controller ≤ 23.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-20345 is a medium-severity Path Traversal: '/dir/../filename' (CWE-26) vulnerability in Cisco Appdynamics Controller. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18060
Vulnerability Data
A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit…
more
this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation structurally stops untrusted path sequences from being used to construct filenames that escape the intended directory.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent this weakness.
Vulnerability identification processes will discover path traversal flaws during scanning or testing.
Hardened configuration baselines can enforce directory restrictions that reduce exploitability.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis and penetration testing.
Secure development lifecycle mandates input validation and path canonicalization that directly prevent directory traversal sequences.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles reduce the attack surface but do not prescribe the specific coding fix.
Secure coding standards require neutralizing '../' sequences and canonicalizing paths before file operations.
Information access restriction limits which files can be reached, mitigating impact but not the root cause.