PT-2019-3084 · Cisco · Cisco Enterprise Nfv Infrastructure

Publicado 2019-08-07 · Atualizado 2021-10-29 · CVE-2019-1953

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software (NFVIS) (affected versions not specified)

Description A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2019-03066

CVE-2019-1953

Produtos afetados

Cisco Enterprise Nfv Infrastructure

Referências · 5

• https://bdu.fstec.ru/vul/2019-03066 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-pwrecov · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1953 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1953 · Nota de Segurança
• https://t.me/cvenotify/22669 · Publicação no Telegram