Sign-up

ID

VAR-202010-1030


CVE

CVE-2020-3483


TITLE

Duo Network Gateway  Inadequate protection of credentials in products

Trust: 0.8

sources: JVNDB: JVNDB-2020-012690

DESCRIPTION

Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG host. Any private keys logged in this way could be viewed by those with access to the DNG host operating system without any need for reversing encrypted values or similar techniques. An attacker that gained access to the DNG logs and with the ability to intercept and manipulate network traffic between a user and the DNG, could decrypt and manipulate SSL/TLS connections to the DNG and to the protected applications behind it. Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7 are affected. Program SSL/TLS connections

Trust: 1.8

sources: NVD: CVE-2020-3483 // JVNDB: JVNDB-2020-012690 // VULHUB: VHN-181608 // VULMON: CVE-2020-3483

AFFECTED PRODUCTS

vendor:ciscomodel:duo network gatewayscope:lteversion:1.5.7

Trust: 1.0

vendor:ciscomodel:duo network gatewayscope:gteversion:1.3.3

Trust: 1.0

vendor:シスコシステムズmodel:duo network gatewayscope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:duo network gatewayscope:eqversion:1.3.3 to 1.5.7

Trust: 0.8

sources: JVNDB: JVNDB-2020-012690 // NVD: CVE-2020-3483

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3483
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3483
value: HIGH

Trust: 1.0

NVD: CVE-2020-3483
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202010-634
value: MEDIUM

Trust: 0.6

VULHUB: VHN-181608
value: LOW

Trust: 0.1

VULMON: CVE-2020-3483
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2020-3483
severity: LOW
baseScore: 3.3
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-181608
severity: LOW
baseScore: 3.3
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3483
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.0
impactScore: 5.2
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2020-3483
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2020-3483
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-181608 // VULMON: CVE-2020-3483 // JVNDB: JVNDB-2020-012690 // CNNVD: CNNVD-202010-634 // NVD: CVE-2020-3483 // NVD: CVE-2020-3483

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.1

problemtype:CWE-256

Trust: 1.0

problemtype:Inadequate protection of credentials (CWE-522) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-181608 // JVNDB: JVNDB-2020-012690 // NVD: CVE-2020-3483

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202010-634

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202010-634

PATCH

title:DUO-PSA-2020-004url:https://duo.com/labs/psa/duo-psa-2020-004

Trust: 0.8

title:Duo Network Gateway Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=130275

Trust: 0.6

sources: JVNDB: JVNDB-2020-012690 // CNNVD: CNNVD-202010-634

EXTERNAL IDS

db:NVDid:CVE-2020-3483

Trust: 2.6

db:JVNDBid:JVNDB-2020-012690

Trust: 0.8

db:CNNVDid:CNNVD-202010-634

Trust: 0.7

db:VULHUBid:VHN-181608

Trust: 0.1

db:VULMONid:CVE-2020-3483

Trust: 0.1

sources: VULHUB: VHN-181608 // VULMON: CVE-2020-3483 // JVNDB: JVNDB-2020-012690 // CNNVD: CNNVD-202010-634 // NVD: CVE-2020-3483

REFERENCES

url:https://duo.com/labs/psa/duo-psa-2020-004

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-3483

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/522.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/189798

Trust: 0.1

sources: VULHUB: VHN-181608 // VULMON: CVE-2020-3483 // JVNDB: JVNDB-2020-012690 // CNNVD: CNNVD-202010-634 // NVD: CVE-2020-3483

SOURCES

db:VULHUBid:VHN-181608
db:VULMONid:CVE-2020-3483
db:JVNDBid:JVNDB-2020-012690
db:CNNVDid:CNNVD-202010-634
db:NVDid:CVE-2020-3483

LAST UPDATE DATE

2024-11-23T22:44:24.921000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-181608date:2020-10-29T00:00:00
db:VULMONid:CVE-2020-3483date:2020-10-29T00:00:00
db:JVNDBid:JVNDB-2020-012690date:2021-05-21T07:52:00
db:CNNVDid:CNNVD-202010-634date:2020-10-30T00:00:00
db:NVDid:CVE-2020-3483date:2024-11-21T05:31:09.763

SOURCES RELEASE DATE

db:VULHUBid:VHN-181608date:2020-10-14T00:00:00
db:VULMONid:CVE-2020-3483date:2020-10-14T00:00:00
db:JVNDBid:JVNDB-2020-012690date:2021-05-21T00:00:00
db:CNNVDid:CNNVD-202010-634date:2020-10-14T00:00:00
db:NVDid:CVE-2020-3483date:2020-10-14T19:15:14.087