How severe is CVE-2024-20345?

CVE-2024-20345 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-20345 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-20345?

CVE-2024-20345 affects Cisco Appdynamics Controller. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-20345?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-20345 have an EU (EUVD) identifier?

Yes. CVE-2024-20345 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18060.

When was CVE-2024-20345 published?

CVE-2024-20345 was published on 2024-03-06 and last updated on 2026-06-17.

CVE-2024-20345

CVE-2024-20345 is a medium-severity vulnerability in Cisco Appdynamics Controller with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-26.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-18060
Weakness: CWE-26
Affected product: Cisco Appdynamics Controller
Published: 2024-03-06
Last modified: 2026-06-17

Description

A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.

Frequently asked questions

What is CVE-2024-20345?: A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.
How severe is CVE-2024-20345?: CVE-2024-20345 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-20345 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-20345?: CVE-2024-20345 affects Cisco Appdynamics Controller. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-20345?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-20345 have an EU (EUVD) identifier?: Yes. CVE-2024-20345 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-18060.
When was CVE-2024-20345 published?: CVE-2024-20345 was published on 2024-03-06 and last updated on 2026-06-17.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-traversal-m7N8mZpF

Affected products (1)

cpe:2.3:a:cisco:appdynamics_controller:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Appdynamics Controller

CVE-2024-20346 — Medium (CVSS 5.4): A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated,…
CVE-2022-20736 — Medium (CVSS 5.3): A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an…

All CVEs affecting Cisco Appdynamics Controller →

Other CWE-26 vulnerabilities

CVE-2024-28064 — Critical (CVSS 9.8): Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal…
CVE-2024-29466 — High (CVSS 8.8): Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code…
CVE-2025-53908 — High (CVSS 8.3): RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path…
CVE-2024-25466 — High (CVSS 7.8): Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local…
CVE-2024-31551 — High (CVSS 7.5): Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete…
CVE-2022-45133 — Medium (CVSS 6.5): Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A…

Browse all CWE-26 vulnerabilities →