PT-2019-3077 · Cisco · Cisco Enterprise Nfv Infrastructure

Publicado 2019-08-07 · Atualizado 2020-10-16 · CVE-2019-1972

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software (NFVIS) (affected versions not specified)

Description The issue is related to insufficient restrictions during the execution of an affected CLI command, allowing an authenticated, local attacker with valid administrator-level credentials to elevate privileges and execute arbitrary commands on the underlying operating system as root. An attacker could exploit this by leveraging the insufficient restrictions during the execution of an affected command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2019-03059

CVE-2019-1972

Produtos afetados

Cisco Enterprise Nfv Infrastructure

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-1972 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-privescal · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03059 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1972 · Aviso do Fabricante