Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Cisco Umbrella Dashboard Session Management Vulnerability (Cisco Cisco Umbrella)

CVE-2019-1807
HIGH 7.6

At a glance

Source
NVD
EPSS
EPSS 1.48 % · percentile 74 ()
State
PUBLISHED
Published
Updated
Assigner
cisco
NVD status
Modified

Search on…

Description

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session when a user authenticates to the application and changes the users credentials via another authenticated session. An attacker could exploit this vulnerability by using a separate, authenticated, active session to connect to the application through the web UI. A successful exploit could allow the attacker to maintain access to the dashboard via an authenticated user's browser session. Cisco has addressed this vulnerability in the Cisco Umbrella Dashboard. No user action is required.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.0HIGH 7.6CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Lcisco
CVSS 3.0HIGH 7.6CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:LNVD · psirt@cisco.com (Secondary)
CVSS 3.0HIGH 8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 6.8AV:N/AC:M/Au:N/C:P/I:P/A:PNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Cisco · Cisco Umbrellaaffected unspecified < n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD