Cisco Data Center Network Manager Arbitrary File Download Vulnerability (Cisco Cisco Data Center Network Manager)
At a glance
- Source
- NVD
- EPSS
- EPSS 29.82 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Modified
Description
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The vulnerability is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this vulnerability by connecting to the web-based management interface of an affected device and requesting specific URLs. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.
Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-file-dwnld
- http://www.securityfocus.com/bid/108904
- https://seclists.org/bugtraq/2019/Jul/11
- http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2019/Jul/7
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | cisco |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-10178
- GCVE · GCVE-0-2019-1621
CERT-FR advisories
- CERTFR-2019-AVI-297 — Multiples vulnérabilités dans Cisco Data Center Network Manager · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:data_center_network_manager:11.0\(1\):*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Data Center Network Manager | affected unspecified < 11.2(1) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |