CVE-2024-20345
Cisco Appdynamics Controller ≤ 23.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-20345 is a medium-severity Path Traversal: '/dir/../filename' (CWE-26) vulnerability in Cisco Appdynamics Controller. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked in the top 18% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18060
Vulnerability Data
A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit…
more
this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation structurally stops untrusted path sequences from being used to construct filenames that escape the intended directory.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes will discover path traversal flaws during scanning or testing.
Hardened configuration baselines can enforce directory restrictions that reduce exploitability.
Secure SDLC practices directly require input validation and path sanitization that prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and path canonicalization that directly prevent directory traversal sequences.
A.8.26 only requires that security requirements (including resilience against SQLi or buffer overflows) be identified and specified during development or acquisition; it does not itself neutralize path traversal sequences or stop exploitation of CWE-26.
Secure architecture principles reduce the attack surface but do not prescribe the specific coding fix.
Secure coding standards require neutralizing '../' sequences and canonicalizing paths before file operations.