Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability (Cisco Cisco Enterprise NFV Infrastructure Software)

CVE-2019-1961
MEDIUM 4.9

En bref

Source
NVD
EPSS
EPSS 1.91 % · centile 80 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
cisco
Statut NVD
Modified

Rechercher sur…

Description

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.

Faiblesses (CWE)

  • CWE-532 — Informations sensibles insérées dans un fichier de journal
  • CWE-20 — Validation d'entrée incorrecte

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Ncisco
CVSS 3.1MEDIUM 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · psirt@cisco.com (Secondary)
CVSS 2.0MEDIUM 6.8AV:N/AC:L/Au:S/C:C/I:N/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Cisco · Cisco Enterprise NFV Infrastructure Softwareaffected unspecified < n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD