PT-2019-2363 · Cisco · Cisco Unified Intelligence Center

Publicado 2019-05-15 · Atualizado 2019-05-17 · CVE-2019-1860

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:N/AC:H/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center (affected versions not specified)

Description The issue is related to incorrect resource identifier control in the monitoring panel of Cisco Unified Intelligence Center. It could allow a remote attacker to impact the confidentiality and integrity of protected information using a specially crafted gadget. The vulnerability is due to the lack of gadget validation, which could be exploited by forcing a user to load a malicious gadget, potentially allowing the attacker to obtain sensitive information, such as current user credentials, or manipulate data between the user's browser and Cisco Unified Intelligence Center.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-99

Identificadores relacionados

BDU:2019-02138

CVE-2019-1860

Produtos afetados

Cisco Unified Intelligence Center

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1860 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cuic-cmdinj · Aviso do Fabricante
• http://securityfocus.com/bid/108354 · Nota
• https://bdu.fstec.ru/vul/2019-02138 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1860 · Aviso do Fabricante