PT-2019-2651 · Cisco · Cisco Application Policy Infrastructure Controller

Publicado 2019-07-03 · Atualizado 2020-10-16 · CVE-2019-1889

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) Software versions (affected versions not specified)

Description The issue is related to the implementation of the REST API in the Cisco Application Policy Infrastructure Controller, specifically with inadequate access restrictions to certain features. This could allow a remote attacker to escalate their privileges to the root level by uploading malicious software. The vulnerability is due to incomplete validation and error checking for the file path when specific software is uploaded.

Recommendations For all affected versions, consider restricting access to the REST API to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the REST API for software uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

CWE-264

Identificadores relacionados

BDU:2019-02537

CVE-2019-1889

Produtos afetados

Cisco Application Policy Infrastructure Controller

Referências · 6

• https://t.me/cvenotify/204 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2019-02537 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1889 · Nota de Segurança
• https://tools.cisco.com/security/center/publicationListing.x · Nota
• https://osv.dev/vulnerability/CVE-2019-1889 · Aviso do Fabricante