PT-2019-2510 · Cisco · Cisco Data Center Network Manager

Pedro Ribeiro · Publicado 2019-06-26 · Atualizado 2020-10-06 · CVE-2019-1621

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to gain access to sensitive files on an affected device. The issue is due to incorrect permissions settings on affected DCNM software. An attacker could exploit this by connecting to the web-based management interface and requesting specific URLs, potentially allowing them to download arbitrary files from the underlying filesystem of the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-264

CWE-22

Identificadores relacionados

BDU:2019-02353

CVE-2019-1621

Produtos afetados

Cisco Data Center Network Manager

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_dcnm_download.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1621 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02353 · Nota de Segurança
• http://packetstormsecurity.com/files/153546/Cisco-Data-Center-Network-Manager-11.1-1-Remote-Code-Execution.html · Nota
• http://securityfocus.com/bid/108904 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-file-dwnld · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1621 · Aviso do Fabricante
• https://seclists.org/bugtraq/2019/Jul/11 · Nota
• http://seclists.org/fulldisclosure/2019/Jul/7 · Nota